CVE-2018-15634

Executive Summary

CVE-2018-15634 is a stored/persistent Cross-Site Scripting (XSS) vulnerability in the attachment management module of Odoo Community and Odoo Enterprise, affecting versions 14.0 and earlier. The flaw allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by crafting a malicious link targeting the attachment management functionality.

The impact is significant for organizations running Odoo ERP, as successful exploitation enables session hijacking, data exfiltration, and unauthorized actions within the ERP context. The CVSS score of 7.1 reflects the high availability of the attack vector and the partial compromise of confidentiality, integrity, and availability, though user interaction is required. Both Community and Enterprise editions are affected, meaning no licensing tier provides inherent protection.

Technical Analysis

The vulnerability resides in the attachment management component of Odoo, a popular open-source ERP system. The NVD description specifies that the flaw is a Cross-Site Scripting (XSS) issue triggered via a crafted link. The attack mechanism involves the web server not properly sanitizing or encoding user-controlled input when processing attachment-related operations, allowing script content to be rendered in a victim's browser.

From a vulnerability-class perspective, this maps to CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack vector is network-based, requiring no authentication (AV:N, PR:N), but demands victim interaction (UI:R) — the victim must click or open a crafted link. The scope is changed (S:C) because the injected script executes in the context of the Odoo web application and can interact with the entire application's DOM, not just the vulnerable component.

The technical mechanism at a class level: when Odoo handles attachment metadata or rendering, it fails to apply context-appropriate output encoding. A remote attacker can craft a URL containing malicious script that, when processed and rendered by the attachment management module, executes in the victim's browser. The precise code path is not disclosed in the available data — insufficient technical detail is available to identify specific functions or methods involved.

The vulnerability affects both Odoo Community (free edition) and Odoo Enterprise (commercial edition) across all versions up to and including 14.0. The "14.0 and earlier" phrasing suggests this was patched in a later release, with the CNA and Debian maintaining fix information. The EPSS score of 0.00899 (56.4th percentile) indicates low but non-zero exploitation likelihood in the wild.

Exploitation Scenarios

Given the available data, no public PoC or exploit code is confirmed. The attack chain is inferred from the vulnerability class (reflected/stored XSS via crafted link).

Step 1 — Reconnaissance/Target Identification:
The attacker identifies Odoo instances by scanning for Odoo-specific response headers, login pages, or web client fingerprinting. Shodan dorks such as "Odoo" or "odoo web client" can reveal exposed instances. The attacker requests the Odoo login page to confirm the version and determine if it is <= 14.0.

Step 2 — Triggering the Flaw:
Since user interaction is required (UI:R), the attacker crafts a malicious URL that points to an Odoo attachment management endpoint or page. The crafted link contains JavaScript payload embedded in a query parameter, fragment, or path component that the attachment management module fails to sanitize.

Step 3 — Payload Execution:
The victim, authenticated to their Odoo instance, clicks the crafted link. The Odoo server responds with a page that embeds the malicious script without proper encoding. The browser executes the script in the context of the Odoo web application domain, giving the attacker script execution inside the victim's authenticated session context.

No public PoC available; attack chain is inferred from vulnerability class. The script payload at the class level could perform any of the following actions: read session cookies and exfiltrate them, interact with Odoo's internal APIs/JSON-RPC to modify records, or render a phishing overlay to harvest user credentials.

Step 4 — Post-Exploitation Impact:
With script execution in the victim's browser, the attacker inherits the victim's privileges within Odoo. This can lead to unauthorized access to business data (CRMs, invoices, inventory), data modification, or lateral movement into connected systems if the victim has additional privileges. In an ERP context, these actions carry significant operational and financial risk.

Impact Assessment

The CVSS v3.1 score of 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates a moderate-to-high severity. The key characteristics:

• Confidentiality Impact (L): Partial disclosure of information within the Odoo environment accessible to the victim's session. Not all data may be exposed, and the attacker lacks direct server access.
• Integrity Impact (L): Partial modification of data — the attacker can potentially alter records accessible to the victim's session, but cannot directly modify server configurations.
• Availability Impact (L): Reduced performance or partial denial of service possible by disrupting the application's client-side functionality.
• Scope Change (S): The vulnerability affects a resource beyond the security scope; the injected script can impact the entire Odoo application.
• User Interaction Required (R): The victim must click a link, reducing the automation potential.

Affected Systems: All Odoo deployments (Community and Enterprise) running version 14.0 or earlier. This includes on-premises installations and potentially cloud-managed instances that have not received patches.

Blast Radius: Given Odoo's popularity as an open-source ERP, the affected install base is substantial. In affected environments, the blast radius extends from the web application client to any data accessible through the victim's session. This includes potential exposure of customer records, financial data, supply chain information, and employee PII. In organizations where Odoo is integrated with other enterprise systems via API, the scope could theoretically extend to connected systems, though the XSS itself operates client-side.

Business Impact: Unauthorized data access and modification can lead to: regulatory compliance violations (GDPR, CCPA), financial fraud, operational disruption, and reputational damage. The ERP context elevates the severity — an attacker who compromises an ERP session can manipulate business-critical workflows.

Detection Guidance

The following detection content targets at-scale monitoring for suspicious activity pattern-matching the XSS class and Odoo attachment management interactions.

Sigma Rule

title: Odoo Attachment Management XSS Attempt (CVE-2018-15634)
id: 93a63d92-Odoo-XSS-CVE-2018-15634-01
status: experimental
description: Detects potential XSS attempts targeting Odoo attachment management endpoints
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    c-uri|contains:
      - 'attachment'
      - 'attachment_tree'
    c-uri|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript%3E'
      - 'alert('
  filter:
    c-uri|contains: '/web/'
  condition: selection and not filter
falsepositives:
  - Legitimate admin usage with file names containing special characters
  - Security scanner activity
level: high
tags:
  - attack.t1059.007
  - cve.2018-15634
  - cwe.79

YARA Rule

rule Odoo_XSS_Attachment_CVE_2018_15634 {
    meta:
        author = "Valters IT Security"
        description = "Detects XSS payload patterns in Odoo attachment URLs"
        cve = "CVE-2018-15634"
        date = "2024-01-01"
        severity = "high"
    strings:
        $a1 = "attachment" nocase
        $a2 = "odoo" nocase
        $b1 = "<script" nocase
        $b2 = "javascript:" nocase
        $b3 = "onerror=" nocase
        $b4 = "onload=" nocase
        $b5 = "alert(" nocase
        $b6 = "/web/image/" nocase
    condition:
        any of ($a*) and (any of ($b*)) and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"Odoo Attachment XSS Attempt (CVE-2018-15634)"; flow:established,to_server; http.uri; content:"attachment"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"javascript:"; nocase; http.uri; content:"alert("; nocase; reference:cve,2018-15634; classtype:web-application-attack; sid:2024033401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.type == "connection" and protocol == "http"
   and http.request.method == "GET"
   and http.request.uri contains "attachment"
   and (http.request.uri contains "<script" or http.request.uri contains "javascript:" or
        http.request.uri contains "onerror=" or http.request.uri contains "onload=")]
  [process where event.type == "start" and process.name == "chrome" or process.name == "firefox"]

Splunk SPL Query

index=web sourcetype=access_combined* 
| where like(uri, "%attachment%") 
| where like(uri, "%<script%") OR like(uri, "%javascript:%") OR like(uri, "%onerror=%") 
  OR like(uri, "%onload=%") OR like(uri, "%alert(%") 
| eval cve="CVE-2018-15634" 
| table _time, src_ip, uri, status, user_agent, referer 
| sort - _time

Wazuh OSSEC Rule

<rule id="100234" level="14">
  <decoded>apache-accesslog</decoded>
  <match>attachment</match>
  <regex>(\%3Cscript\%3E|<script|javascript:|onerror=|onload=|alert\()</regex>
  <description>Odoo attachment XSS attempt (CVE-2018-15634)</description>
  <group>web_application_attack,xss,odoo,</group>
  <mitre>
    <id>T1059.007</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY. Two independent sources (CNA and Debian) confirm a fix exists, though the complete disclosure of the specific patched version is not provided in the NVD data. Organizations should treat this as patched in a version later than 14.0.

Immediate Mitigations (before patching):

1. Restrict access to Odoo web interface via network-level controls (firewall rules, ACLs) to trusted IP ranges only.
2. Implement a Web Application Firewall (WAF) with rules to block XSS patterns in Odoo attachment URLs.
3. Educate users not to click links in untrusted emails or message that could point to the Odoo instance.
4. Monitor web server logs for XSS patterns, particularly in URI paths containing "attachment".
5. If feasible, enforce Content-Security-Policy (CSP) headers via a reverse proxy in front of Odoo to limit script execution, though this may have functional impact.

Patch/Upgrade Steps:

1. Ensure the Odoo instance is updated to a version newer than 14.0. The fix is confirmed by CNA and Debian. Odoo's current release receives security patches from the vendor.
2. For Debian/Ubuntu installations using the odoo package (Debian alternative), check the Debian patch tracker for the relevant CVE and apply the updated package via apt upgrade.
3. For source installations, subscribe to Odoo's security announcements and apply the relevant version that addresses this CVE.
4. After patching, verify the fix by attempting to craft XSS payloads in attachment management pages — they should be inert.

Long-Term Hardening:

• Maintain a regular patching cadence for Odoo — this CVE (disclosed earlier but affecting 14.0) demonstrates the risk of running legacy ERP versions.
• Use TLS/HTTPS to protect session cookies, reducing the impact of session hijacking even if XSS is exploited.
• Implement strict input validation and output encoding at the application layer.
• Use virtualization/containerization to limit the blast radius of any Odoo compromise.
• Enforce least-privilege access controls within Odoo roles and integrate with enterprise SSO to reduce the impact of account compromise.
• Regularly audit web logs and use EDR/XDR on hosts accessing the Odoo application.

References

1. NVD Entry — National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2018-15634 (Primary source for description and CVSS data).
2. CNA Advisory — Odoo Security Advisory (fix confirmed by CNA; specific advisory URL not provided in the available data).
3. Debian Security Tracker — Debian patch source: https://security-tracker.debian.org/tracker/CVE-2018-15634 (Confirming fix and package versions).
4. Odoo Official Security Page — https://www.odoo.com/security (Vendor's general security disclosures; CVE details may be searchable here).
5. Exploit-DB / Metasploit — Check for any later-disclosed public PoC. As of the data provided, PoC status: None — no public exploit code or Nuclei template exists for this CVE.

Known Threat Actor Campaigns: No specific campaigns or exploit-in-the-wild evidence is documented for this CVE. The CISA KEV (Known Exploited Vulnerabilities) catalog does not include this CVE. The EPSS percentile of 56.4% indicates the vulnerability is in the upper half of likely-exploited CVEs, but the relatively low absolute score (0.00899) suggests exploitation is not widespread as of the data date.