External risk intelligence

QD SSRF Vulnerability with Network Attack Vector

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2023-46945

The product is a web-based application (QD) that typically functions as a web service. SSRF vulnerabilities in web applications are commonly exposed when the service is deployed to handle web traffic, making it reachable from the internet in standard deployment patterns.

Server-Side Request Forgery

Qd Today Qd

20220208 to 20230821

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the QD product that could allow unauthorized access to internal systems. The issue, a server-side request forgery, means an attacker could trick the software into making requests on their behalf, potentially exposing sensitive information or enabling further compromise. The main concern is confirming relevance and exposure to internal systems.

An attacker can trick software into making requests.
This could expose internal systems and sensitive data.
Confirm relevance and exposure to internal systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the QD application. This would allow them to trick the server into making requests to internal or external resources it shouldn't access. Successful exploitation could lead to unauthorized access to sensitive information or other internal systems.

No authentication or user interaction required.
Crafted request triggers the vulnerability.
Risk of unauthorized access to internal resources.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to trick the QD application into making unintended network requests to internal or external resources. This could potentially expose sensitive system information or allow the attacker to interact with other services.

Internal network resources or services.
Via a crafted malicious request.
Information disclosure or unauthorized service interaction.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical Server-Side Request Forgery (SSRF) vulnerability in QD affects organizations using the QD product. The first practical step is to identify all instances of QD within your environment, confirm their external reachability and business criticality, and then locate the accountable owner for each instance. Remediation planning should be risk-based, considering the potential impact of SSRF, which can lead to unauthorized access and data exfiltration.

Application owners should own the issue.
Verify external reachability and criticality first.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the QD software product?

QD is a web-based application designed to operate as a network service. It is primarily used to manage and process web traffic, often acting as a bridge between users and backend resources. Because it functions as a web service, it is typically configured to handle incoming requests from a network.

How does CVE-2023-46945 work?

This vulnerability is classified as Server-side request forgery (CWE-918). It occurs when the QD software is manipulated into making unauthorized network requests on behalf of an attacker. By sending a specially crafted request, an attacker can force the server to interact with internal or external resources that should otherwise be protected or inaccessible.

Do I need to be logged in to trigger this bug?

No. The vulnerability does not require authentication or any form of user interaction to be triggered. A malicious actor can initiate the process simply by sending a crafted request to the application. If the request reaches the server, the underlying flaw allows the unauthorized action to occur without needing valid credentials.

Is my QD installation at risk?

Halo Surface Signal indicates that QD is typically deployed as a web-facing service, which increases the likelihood that it is reachable from the internet. If your instance is exposed to public network traffic, it is at higher risk because attackers can reach the application directly to send the malicious requests required to exploit this issue.

What should I do to address this vulnerability?

Begin by creating an inventory of all QD instances within your infrastructure to understand where they are deployed. Evaluate each instance based on its network reachability and the sensitivity of the data it handles. Identify the business owners responsible for these systems so you can coordinate a risk-based plan to secure or update the software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.