Qlik Sense ZeroQlik Bugs: Pre-Auth RCE Used by Cactus

What to do

1. Inventory every Qlik Sense Enterprise for Windows server and record its release and patch level.
2. Upgrade to a current supported release; at minimum be past the CVE-2023-48365 fix for your track.
3. Remove direct internet exposure: use a VPN, secure remote access or an IP allowlist.
4. Check each server for qle.ttf or qle.woff in the QMC fonts folder and for unusual Scheduler.exe child processes.
5. If you find either, treat it as a ransomware intrusion: isolate the host, hunt across the network and rotate the credentials the server and its service accounts use.

How to check if you are affected or compromised

• Look for qle.ttf or qle.woff under the Client\qmc\fonts folder of the Qlik Sense install; Fox-IT and DIVD used these files as the Cactus indicator.
• Review EDR or Sysmon data for Scheduler.exe spawning cmd.exe or PowerShell, or downloads of AnyDesk, Plink, ManageEngine UEMS or rclone.
• Search Qlik proxy audit logs for anonymous requests under /resources/ ending in .ttf or .woff that contain ../ sequences.
• Test patch level with Fox-IT's request for /resources/autogenerated/product-info.json?.ttf: 200 with JSON suggests vulnerable, 302 to login suggests patched.

What happened#

On August 29, 2023, Qlik published an advisory for two bugs in Qlik Sense Enterprise for Windows, reported by Adam Crosser and Thomas Hendrickson of Praetorian. CVE-2023-41266 is a path traversal (CVSS 8.2) that gives an unauthenticated attacker an anonymous session. CVE-2023-41265 is HTTP request tunneling (CVSS 9.6) that lets requests run on the backend repository server. Qlik said that combined, they could allow unauthenticated remote code execution.

Praetorian's ZeroQlik write-up explains the chain. The proxy allowed unauthenticated paths that began with /resources/qmc/fonts/ and ended in .ttf, without normalizing ../. That reached internal REST endpoints. The proxy and backend also disagreed on Content-Length versus Transfer-Encoding, so a smuggled request could impersonate the internal sa_repository account. From there, an external program task runs any command through the Scheduler service.

The first fix was incomplete. Qlik shipped new patches on September 20, 2023 for CVE-2023-48365, which the CVE record describes as an incomplete fix for CVE-2023-41265. On November 28, 2023, Arctic Wolf reported Cactus ransomware intrusions that likely used one or more of the three bugs. CISA added CVE-2023-41265 and CVE-2023-41266 to the KEV catalog on December 7, 2023, flagged for ransomware use. CVE-2023-48365 followed on January 13, 2025.

Who is affected#

Self-managed Qlik Sense Enterprise for Windows on May 2023 Patch 3, February 2023 Patch 7, November 2022 Patch 10, August 2022 Patch 12 or earlier. A server patched only for the August bugs is still open to CVE-2023-48365 until it reaches August 2023 Patch 2 or the matching patch on its track. Qlik Cloud and QlikView are not affected.

Do you really need to act?#

Check, and take it seriously if the server faced the internet. Fox-IT's April 2024 scan found 5,205 internet-facing Qlik Sense servers, 3,143 still vulnerable to CVE-2023-48365, and 122 showing the Cactus indicator. Forty-six of those 122 had since been patched, which shows that patching alone does not clean a server. Qlik servers hold data connections to warehouses and business systems, so a breach rarely stays on one host. Fully patched servers that were never exposed can relax.

What to do now#

1. Record each server's release and patch level in the QMC or Qlik's installer.
2. Upgrade to a current supported release, at minimum past the CVE-2023-48365 fix for your track.
3. Take Qlik Sense off the open internet; use a VPN, secure remote access or an IP allowlist.
4. Run the checks below on any server that was exposed in late 2023 or 2024.
5. If you find the indicator, isolate the host and handle it as a ransomware intrusion, not a patch task.

How to tell if you were hit#

• Run dir "C:\Program Files\Qlik\Sense\Client\qmc\fonts\qle.*" (adjust for your install path). Cactus wrote command output to qle.ttf or qle.woff, which are not part of a default install.
• In EDR or Sysmon data, look for Scheduler.exe spawning cmd.exe or PowerShell. Arctic Wolf saw AnyDesk, a renamed Plink, ManageEngine UEMS disguised as Qlik files, and rclone renamed to svchost.exe.
• Search proxy audit logs for anonymous requests under /resources/ ending in .ttf or .woff that contain ../.
• Check patch level with curl -sk -o /dev/null -w '%{http_code}' -H 'Host: localhost' 'https://qlik.example.com/resources/autogenerated/product-info.json?.ttf'. Fox-IT reads 200 as vulnerable and 302 as not.

Timeline#

• Aug 29, 2023 — Qlik advisory and fixes for CVE-2023-41265 and CVE-2023-41266.
• Aug 31, 2023 — Praetorian publishes ZeroQlik details.
• Sep 20, 2023 — Qlik patches the incomplete fix, later CVE-2023-48365.
• Nov 28, 2023 — Arctic Wolf reports Cactus ransomware exploitation.
• Dec 7, 2023 — CISA adds both CVEs to KEV.
• Apr 25, 2024 — Fox-IT reports 122 likely compromised servers.
• Jan 13, 2025 — CVE-2023-48365 joins KEV.

Vulnerability records

• CVE-2023-41266 · KEV 2023-12-07 · A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier…
• CVE-2023-41265 · KEV 2023-12-07 · An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Qlik — Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265) community.qlik.com
2. Qlik — Qlik Sense Enterprise for Windows - New Security Patches Available Now community.qlik.com
3. CVE record — CVE-2023-41265 cve.org
4. CVE record — CVE-2023-41266 cve.org
5. CVE record — CVE-2023-48365 cve.org
6. CISA — Known Exploited Vulnerabilities: CVE-2023-41265 cisa.gov
7. Praetorian — ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal praetorian.com
8. Arctic Wolf Labs — Qlik Sense Exploited in Cactus Ransomware Campaign arcticwolf.com
9. Fox-IT (NCC Group) — Sifting through the spines: identifying (potential) Cactus ransomware victims nccgroup.com