CVE-2015-3623 in Qlikview
Summary
by MITRE
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2025
The CVE-2015-3623 vulnerability represents a critical XML external entity processing flaw in QlikTech Qlikview versions prior to 11.20 SR12, specifically affecting the AccessPoint.aspx component. This vulnerability falls under the CWE-611 weakness category, which encompasses improper restriction of XML external entity references, making it a prime example of insecure XML processing that can lead to severe security implications. The flaw exists within the web application's XML parser implementation where it fails to properly validate and sanitize external entity references in XML data submitted through HTTP requests, creating an attack surface that adversaries can exploit to execute malicious operations on the underlying system.
The technical exploitation of this vulnerability enables remote attackers to perform server-side request forgery attacks by crafting specially formatted XML payloads that reference external entities hosted on attacker-controlled servers. When the vulnerable Qlikview application processes these malformed XML requests through AccessPoint.aspx, the XML parser automatically resolves external entity references, leading to unintended network requests to specified endpoints. This mechanism allows attackers to bypass network segmentation controls and potentially access internal resources that would otherwise be protected from external network access. The vulnerability specifically targets the application's XML processing capabilities, where the system fails to properly isolate external entity declarations from the internal processing environment, creating a pathway for unauthorized information disclosure.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to conduct comprehensive reconnaissance and potentially escalate privileges within the affected environment. Through careful crafting of XML payloads, adversaries can force the vulnerable application to read arbitrary files from the server's file system, including sensitive configuration files, database connection strings, and other system resources. The SSRF capabilities also allow attackers to probe internal network services and potentially gain access to backend systems that are not directly exposed to the internet. This vulnerability particularly affects organizations that rely on Qlikview for business intelligence and data analysis, as the compromised application can serve as a foothold for further attacks within the enterprise network.
Organizations should implement multiple layers of defense to mitigate this vulnerability, beginning with immediate patching of affected Qlikview installations to version 11.20 SR12 or later, which contains the necessary fixes for proper XML entity validation. Network segmentation strategies should be enforced to limit access to the vulnerable AccessPoint.aspx endpoint, while implementing web application firewalls that can detect and block suspicious XML content. Input validation controls must be strengthened to ensure that all XML data received by the application undergoes strict sanitization and entity resolution restrictions. Security monitoring should be enhanced to detect unusual patterns of network requests originating from the vulnerable application, which could indicate exploitation attempts. Additionally, organizations should consider implementing principle of least privilege controls for the Qlikview application, limiting its ability to access sensitive files or network resources beyond what is necessary for legitimate operation, thereby reducing the potential impact of successful exploitation attempts.