CVE-2018-15638

Executive Summary

CVE-2018-15638 is a stored cross-site scripting (XSS) vulnerability located in the mail module of Odoo Community and Odoo Enterprise versions 13.0 and earlier. A remote, unauthenticated attacker can inject arbitrary web script that executes in the browser of a victim user by crafting malicious channel names within the messaging/conversation system. Successful exploitation enables session hijacking, administrative account takeover, and lateral movement within the Odoo platform. The vulnerability carries a CVSS score of 7.1 (High) and is exploitable over the network without requiring authentication, though it requires user interaction (a victim viewing the malicious channel name).

Technical Analysis

The Odoo mail module implements real-time messaging and conversation channels, often referred to as discussion channels or mail channels. These channel names are user-supplied input, intended to be displayed to all participants in the conversation. The vulnerability arises because the application fails to properly sanitize or encode channel names before rendering them in the browser.

The attack mechanism is a classic stored/cross-site scripting flaw within the context of chat and messaging functionality. When a user creates or renames a channel, the name string is persisted in the database without adequate validation. When other users subsequently view their inbox or open the conversation list, the malicious channel name is retrieved from storage and rendered without proper output encoding, causing the injected HTML/JavaScript to execute in the victim's browser session.

Because the Odoo mail module is integral to the platform's collaboration suite, the malicious payload is rendered across multiple views, including the dashboard, chat windows, and notification drop-downs. The persisted nature of the payload means that each time a victim visits the affected view, the script re-executes, making the vulnerability persistent and highly repeatable.

The NVD description does not provide code-level specifics, such as the exact template files or rendering functions involved. Sufficient technical detail is unavailable at the function or class level. However, the vulnerability class is well understood: it is a failure to apply contextual output encoding (i.e., HTML entity encoding) to untrusted data before embedding it into a webpage.

The attack surface is any internet-facing Odoo instance with the mail module enabled, which is the default in most deployments. The module exposes the channel creation and management functionality to all authenticated users, and in some configurations, to unauthenticated users via public channels or portal features.

It should be noted that the CVE metadata lists CWE as N/A, but based on the vulnerability class described (persistent cross-site scripting from insufficient input sanitization), CWE-79 (Improper Neutralization of Input During Web Page Generation) is the most applicable classification.

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability; the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1: Reconnaissance and Target Identification

An attacker identifies Odoo instances exposed to the internet. This can be accomplished through Shodan/Censys queries for Odoo login pages or by scanning for characteristic HTTP responses. The attacker then enumerates the target to determine whether the mail module is active. This can be done by accessing the /mail endpoint or observing the presence of messaging features in the web UI. Version fingerprinting may be performed by inspecting the login page footer, static asset hashes, or the /web/webclient/version endpoint response, allowing the attacker to confirm the target is running version 13.0 or earlier.

Step 2: Triggering the Flaw — Injecting the Payload

The attacker authenticates to the Odoo instance (or, in some configurations, interacts with public channels without authentication) and navigates to the messaging module. The attacker creates a new channel or renames an existing one, setting the channel name to a crafted payload. The payload is a string containing JavaScript encapsulated in HTML tags, for example, a script tag or an event-handler attribute such as onmouseover. Because input sanitization is missing, the payload is stored verbatim in the Odoo database as the channel's display name.

Step 3: Payload Execution

Another user (the victim), typically an administrator or privileged user, opens the messaging interface. The list of channels is rendered from the database. The malicious channel name is inserted into the DOM without output encoding. The browser parses the injected HTML and executes the JavaScript payload in the context of the victim's Odoo session and the legitimate site origin.

Step 4: Post-Exploitation Impact

The injected JavaScript executes with the victim's session context, enabling a range of malicious actions:

• Session Hijacking: The script can read the victim's session cookies (assuming they are not HttpOnly) and exfiltrate them to an attacker-controlled server, allowing the attacker to impersonate the victim.
• Account Takeover: The script can issue authenticated API requests to change the victim's password, email address, or security settings.
• Privilege Escalation: If the victim is an administrator, the script can create new administrator accounts, modify system settings, enable debug mode, or install malicious modules.
• Data Exfiltration: The script can access any data visible to the victim within the Odoo web client, including customer records, sales orders, invoices, warehouse data, and other sensitive business information.
• Lateral Movement: The attacker can use the compromised administrator session to pivot to backend services, access the underlying database, or connect to the server via Odoo's debugging interfaces.

The attack is particularly dangerous because it requires only a low-privileged account (or, in some cases, no account at all) to plant the payload, yet the execution occurs in the context of any user viewing the channels list — a vector that can take down the entire enterprise deployment.

Impact Assessment

The CVSS base score is 7.1 (High). While the vector string is not provided in the NVD data, the attack characteristics described allow a reasonable reconstruction: the attack vector is Network (remote exploitation), the complexity is Low (no special conditions required), and no privileges are required (Privileges Required: None) since channel creation may be available to unauthenticated or low-privileged users. The scope is Changed, as the injected script executes in the victim's browser, which is a different security context than the attacker's. Confidentiality, Integrity, and Availability impacts are all Low, as the direct impact is on the browser session rather than the underlying server, but the downstream consequences (account takeover, data theft) can be severe.

Business Impact:

• Confidentiality Breach: Exposure of ERP data (finance, HR, CRM, inventory) to unauthorized parties.
• Integrity Compromise: Unauthorized modification of business records, pricing, or user permissions.
• Compliance Violations: GDPR, SOX, or HIPAA violations if customer or financial data is exfiltrated.
• Reputational Damage: Loss of customer trust if the breach becomes public.
• Operational Disruption: Full takeover of the Odoo instance can lead to ransomware deployment or system destruction.

Affected Systems:

• Odoo Community Edition 13.0 and earlier.
• Odoo Enterprise Edition 13.0 and earlier.
• Any deployment using the mail (discussion) module, which is enabled by default.

Blast Radius: Every user of the Odoo instance is a potential victim. The XSS is stored, meaning it persists until the malicious channel is deleted. In a large enterprise with hundreds of users, a single malicious channel name can expose the entire user base. If the administrator is compromised, the blast radius extends to the server OS and all integrated systems.

The EPSS score of 0.00687 (49.5th percentile of exploited CVEs) indicates that, as of the score publication, exploitation in the wild was not widespread, but the vulnerability is within the range where active exploitation has been observed for similar CVEs. The CISA KEV (Known Exploited Vulnerabilities) catalog does not list this CVE, indicating it has not yet been weaponized in campaigns tracked by CISA.

Detection Guidance

Sigma Rule

title: Odoo Mail Channel XSS Payload Injection (CVE-2018-15638)
id: 8f3a21c4-d9e2-4b1a-9c34-7a6c5e9f2b80
status: experimental
description: Detects creation of Odoo mail channels with names containing XSS payload indicators (script tags, event handlers) that exploit CVE-2018-15638
author: Valtersit Threat Intel
date: 2024/01/15
logsource:
  category: application
  product: odoo
  service: web
detection:
  selection_main:
    event.action: 'channel_create'
  selection_injection:
    event.channel_name|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - 'onclick='
      - 'img src='
      - '&lt;script'
  condition: selection_main and selection_injection
level: high
falsepositives:
  - Legitimate channel names containing these strings (unlikely but possible in rare business contexts)

YARA Rule

rule Odoo_XSS_ChannelName_CVE_2018_15638 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects XSS payload strings in Odoo log files or database dumps associated with CVE-2018-15638"
        cve = "CVE-2018-15638"
        date = "2024-01-15"
        severity = "high"
    strings:
        $script = /<script[\s>]/ nocase
        $event_handler = /on(load|error|mouseover|click|focus|blur|change|submit|keypress|keydown|keyup)\s*=/ nocase
        $js_protocol = /javascript\s*:/ nocase
        $img_payload = /<img[^>]+src[^>]+onerror/i
        $svg_payload = /<svg[^>]+onload/i
        $iframe_payload = /<iframe[^>]+src/i
    condition:
        any of ($script, $event_handler, $js_protocol, $img_payload, $svg_payload, $iframe_payload) and
        filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Odoo CVE-2018-15638 XSS Channel Name Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/mail/channel"; nocase; http.request_body; pcre:"/(?:<script[\s>]|javascript\s*:|on(?:error|load|mouseover|click)\s*=|<\s*img[^>]+src[^>]+onerror)/i"; classtype:web-application-attack; reference:cve,CVE-2018-15638; sid:202456789; rev:1; metadata:affected_product Odoo, attack_target Web_Application, deployment Perimeter, tag XSS, signature_severity Major, created_at 2024_01_15)

Elastic Detection

any where
  process.name == "odoo-server" or process.name == "odoo" or event.module == "auditd" or
  event.module == "system"
  and (
    (event.action in ("channel_create", "channel_rename", "write") and
     wildcard(message, "*<script*") or
     wildcard(message, "*javascript:*") or
     wildcard(message, "*onerror=*") or
     wildcard(message, "*onload=*") or
     wildcard(message, "*onmouseover=*") or
     wildcard(message, "*onclick=*") or
     wildcard(message, "*img src=*")
    )
    or
    (event.module == "httpd" and
     wildcard(url.path, "*/mail/channel*") and
     wildcard(request.body, "*<script*") or
     wildcard(request.body, "*javascript:*") or
     wildcard(request.body, "*onerror=*")
    )
  )

Splunk SPL Query

index=web OR index=proxy OR index=odoo 
  (sourcetype="access_combined" OR sourcetype="odoo:log" OR sourcetype="ospid")
  AND (method="POST" AND uri_path="*/mail/channel*")
  AND (form_data="*<script*" OR form_data="*javascript:*" OR form_data="*onerror=*" 
       OR form_data="*onload=*" OR form_data="*onmouseover=*" OR form_data="*onclick=*" 
       OR form_data="*img src=*" OR form_data="*svg onload*" OR form_data="*iframe src=*")
  OR 
  (sourcetype="odoo:log" AND message="*channel*" AND (message="*<script*" OR message="*javascript:*" 
       OR message="*onerror=*" OR message="*onload=*" OR message="*onmouseover=*" OR message="*onclick=*"))
  | table _time, src_ip, dest_host, uri_path, form_data, user, status
  | sort - _time

Wazuh OSSEC Rule

<group name="odoo,cve-2018-15638,">
  <rule id="100238" level="12">
    <decoded_as>json</decoded_as>
    <field name="source">odoo.log</field>
    <if_sid>100200</if_sid>
    <match>channel</match>
    <regex>.*(&lt;script|javascript:|on(error|load|mouseover|click)\s*=|<img[^>]+src[^>]+onerror|<svg[^>]+onload|<iframe[^>]+src).*</regex>
    <description>Possible exploitation of CVE-2018-15638 (Odoo XSS via channel name injection)</description>
    <group>web_application_attack,</group>
  </rule>

  <rule id="100239" level="10">
    <decoded_as>json</decoded_as>
    <field name="source">apache-access</field>
    <if_sid>100238</if_sid>
    <url>/mail/channel</url>
    <method>POST</method>
    <regex>.*(&lt;script|javascript:|on(error|load|mouseover|click)\s*=|<img[^>]+src[^>]+onerror|<svg[^>]+onload|<iframe[^>]+src).*</regex>
    <description>HTTP request containing XSS payload targeting Odoo mail channel endpoint (CVE-2018-15638)</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Both the CNA (Odoo) and Debian have independently confirmed and released fixes for this vulnerability, giving high confidence that the patch addresses the issue.

1. Immediate Mitigations

• Upgrade Immediately: Upgrade to the latest patch release of Odoo 13.0 or migrate to Odoo 14.0 or later. If an upgrade is not immediately feasible, apply the vendor's security patch for the mail module.
• Restrict Channel Creation Privileges: Temporarily restrict the ability to create new channels or rename existing ones to trusted administrators only. In Odoo, this can be achieved by modifying the access control lists (ACLs) in developer mode or via group settings.
• Web Application Firewall (WAF) Rules: Deploy a WAF rule to block requests to channel creation endpoints that contain XSS payload patterns (<script, javascript:, onerror=, etc.). This provides a stop-gap measure until patching is complete.
• Disable Public Registration: If the Odoo instance allows public registration or portal users, disable it to reduce the attack surface, as unauthenticated or low-privileged attacker accounts are the primary vector.

2. Patch/Upgrade Steps

1. Verify Version: Confirm your Odoo version. Run odoo-bin --version or check the login page footer.
2. Backup: Take a full backup of the Odoo database and the /etc/odoo configuration directory.
3. Upgrade: Follow the official Odoo upgrade guide (https://odoo.com/documentation/16.0/administration/upgrade.html). If upgrading within the same major version (e.g., 13.0 to 13.0 latest), simply replace the source and restart the service. For major upgrades (13.0 → 14.0), use the Odoo upgrade tool or follow the migration script.
4. Test: In a staging environment, test the upgrade with a copy of the production database to ensure all custom modules are compatible.
5. Deploy: Roll out the upgrade to production during a maintenance window.
6. Post-Patch Audit: After patching, review all existing channel names for any previously injected malicious content and remove any that are suspicious.

3. Long-Term Hardening

• Input Validation: Enable Odoo's built-in sanitization features and ensure all custom modules also implement output encoding for user-supplied data.
• Security Headers: Configure the web server to send Content-Security-Policy headers that restrict script execution to trusted sources, mitigating the impact of any future XSS.
• Session Cookie Security: Set the HttpOnly flag on Odoo's session cookie to prevent JavaScript access to session tokens, as configured in the web server or Odoo configuration.
• Monitor CVE Advisories: Subscribe to Odoo's security advisory mailing list (https://www.odoo.com/security) and the Debian Security Tracker for future CVEs.
• Network Segmentation: Place Odoo behind a reverse proxy and limit direct exposure to the internet where business processes allow.
• Regular Penetration Testing: Include XSS testing (both stored and reflected) in any web application security assessment, with specific attention to user-controlled strings rendered in the web UI.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2018-15638 — Official NIST vulnerability record with the CVE description and scoring details.
2. Odoo Security Advisory: https://www.odoo.com/security — Odoo's official security advisory page, listing confirmed fixes for this vulnerability (details on the specific advisory available to registered customers).
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2018-15638 — Debian's confirmation of the fix and their package update details for Odoo.
4. CVE Mitre: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15638 — MITRE's CVE record, providing cross-references to additional sources.
5. EPSS Data: https://www.first.org/epss/ — FIRST.org's Exploit Prediction Scoring System, used to estimate likelihood of exploitation for this CVE.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the CISA KEV catalog, this CVE is NOT listed as known exploited. No public exploit code has been released for this CVE, and no specific threat actor campaigns have been publicly attributed to it. However, the vulnerability class (stored XSS in an ERP platform) has been actively exploited in other CVEs targeting web applications, and the EPSS score (0.00687) places it in the 49.5th percentile of all scored CVEs, indicating a moderate but not imminent exploitation likelihood. Security teams should treat this as a high-priority patch item given the severity of a potential compromise of an ERP system.