CVE-2023-41265

CVE-2023-41265 is a notable software vulnerability that was exploited by the threat actor known as Magnet Goblin. This flaw, present in the Qlik Sense business analytics servers, pertains to software design or implementation. The vulnerability was one of several weaponized by Magnet Goblin in their cyber-attacks, which included other vulnerabilities in Magento and Ivanti Connect Secure. The exploitation of CVE-2023-41265 led to an HTTP interpretation issue due to inadequate validation of HTTP requests. This problem arose from an incomplete fix for #VU80193, demonstrating the potential risk of partial solutions to such vulnerabilities. Other related vulnerabilities in Qlik Sense were also exploited by Magnet Goblin, including CVE-2023-41266 and CVE-2023-48365, the latter being a direct consequence of the initial CVE-2023-41265 vulnerability. Magnet Goblin's attacks targeted multiple systems, leveraging these vulnerabilities to gain unauthorized access. In addition to Qlik Sense servers, the actor attacked Ivanti Connect Secure using CVE-2023-46805 and multiple 2024 CVEs, Magento using CVE-2022-24086, and possibly Apache ActiveMQ servers. These broad-based attacks underscore the importance of comprehensive system security measures and prompt patching of identified vulnerabilities.