CVE-2025-61138
📋 TL;DR
Qlik Sense Enterprise v14.212.13 contains an information leak vulnerability via the /dev-hub/ directory that exposes sensitive data. This affects organizations running this specific version of Qlik Sense Enterprise. Attackers can access unauthorized information without authentication.
💻 Affected Systems
- Qlik Sense Enterprise
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Exposure of sensitive configuration data, credentials, or proprietary business intelligence that could lead to further system compromise or data theft.
Likely Case
Unauthorized access to internal system information, configuration details, or metadata that could aid attackers in reconnaissance for further attacks.
If Mitigated
Limited exposure of non-critical information with proper access controls and monitoring in place.
🎯 Exploit Status
The vulnerability is publicly documented with proof-of-concept details available in the provided reference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Qlik's official security advisories for patch availability. If no patch exists, upgrade to a supported version or apply workarounds.
🔧 Temporary Workarounds
Restrict access to /dev-hub/ directory
allConfigure web server or application firewall to block or restrict access to the vulnerable directory.
# Example for Apache: RewriteRule ^/dev-hub/ - [F,L]
# Example for Nginx: location /dev-hub/ { deny all; }
Network segmentation
allRestrict network access to Qlik Sense servers to authorized users only.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor access logs for unauthorized requests to /dev-hub/ directory
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://<qlik-server>/dev-hub/ and check if sensitive information is exposed.Check Version:
Check Qlik Sense Management Console or run: qlik version (platform dependent)Verify Fix Applied:
Verify that accessing /dev-hub/ returns appropriate access denied or not found responses.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /dev-hub/ directory from unauthorized sources
- Unusual access patterns to development endpoints
Network Indicators:
- Traffic to /dev-hub/ path from unexpected IP addresses
SIEM Query:
source="web_server_logs" AND uri_path="/dev-hub/*" AND NOT src_ip IN (authorized_ips)