CVE-2018-15645

Executive Summary

CVE-2018-15645 is an improper access control vulnerability in the message routing component of Odoo Community 12.0 and earlier, as well as Odoo Enterprise 12.0 and earlier. A remote authenticated attacker can exploit this flaw by crafting malicious payloads to create arbitrary records within the Odoo instance, potentially leading to privilege escalation. With a CVSS base score of 8.1, this vulnerability poses a high severity risk to organizations running affected Odoo versions, particularly those exposing their ERP systems to untrusted networks. No public exploit code or CISA KEV listing is currently available, and patch confirmation is based on a single source (Debian) with moderate confidence.

Technical Analysis

Vulnerability Class and Mechanism

CVE-2018-15645 falls under the class of improper access control (CWE-284 is the closest matching category; the NVD entry does not explicitly assign a CWE identifier, so classification is inferred). The vulnerable component is the message routing subsystem within Odoo — the module responsible for handling inbound and internal messages, notifications, and inter-object communication.

The core issue stems from insufficient authorization checks when messages are routed through Odoo's internal messaging framework. Odoo's messaging layer processes records and triggers actions based on the content and routing rules of incoming messages. In affected versions (12.0 and earlier), the routing logic fails to adequately verify whether the authenticated user initiating the message has the necessary object-level or model-level permissions to create the records being referenced or requested.

Attack Surface

• Attack vector: Network-based, requiring prior authentication (low complexity, no user interaction).
• Authentication requirement: The attacker must possess a valid account within the Odoo instance, although no special privileges are required — any standard user account suffices.
• Targeted component: The message routing / messaging subsystem, which is present in both Community and Enterprise editions.
• Exposure scope: Any Odoo installation reachable via HTTP/HTTPS with user accounts enabled. This includes internet-facing ERP deployments as well as internal installations where untrusted users have accounts.

Technical Detail Gaps

The NVD description does not provide specific function names, URL endpoints, or code-level identifiers. Sufficient technical detail is not available in the provided data to enumerate exact internal APIs or method names involved in the flaw. The vulnerability is understood at the class level: the routing mechanism does not enforce access control on record creation operations triggered via crafted message payloads.

Affected Versions

The NVD description identifies:

• Odoo Community 12.0 and earlier
• Odoo Enterprise 12.0 and earlier

This means all releases from initial versions up to and including 12.0 are affected. The affected version field in the intelligence data is empty, but the description explicitly states "12.0 and earlier" for both editions.

Exploitation Scenarios

Precondition: The attacker must have valid credentials for an account on the target Odoo instance. This could be obtained via phishing, credential stuffing, leaked credentials, or by registering a new account if self-registration is enabled.

Step 1: Reconnaissance and Target Identification

An attacker first identifies Odoo instances by fingerprinting. Odoo has distinctive characteristics that aid identification:

• Default web login paths (e.g., /web/login)
• Unique HTTP response headers (X-Odoo-Version in some configurations)
• Specific server banner strings and session cookie names

The attacker then validates the version to confirm it is 12.0 or earlier, either by observing the login page footer (which displays the version number by default) or by probing known version-specific paths.

Step 2: Authentication and Session Establishment

The attacker authenticates with the compromised or registered credentials. Standard Odoo authentication involves POSTing credentials to the web login endpoint, receiving a session cookie, and potentially an account-scoped access token.

Step 3: Triggering the Improper Access Control Flaw

With an authenticated session established, the attacker crafts malicious payloads targeting the message routing functionality. The specific mechanics:

1. Crafting the crafted payload: The attacker constructs message payloads that the routing engine processes. These payloads are designed to reference record creation operations that the authenticated user does not have permission to execute directly.

2. Message routing exploitation: The message routing subsystem processes these crafted payloads. The flaw lies in the routing logic's failure to perform adequate access control checks — the routing mechanism processes the message and triggers record creation without verifying whether the initiating user has the appropriate permissions for the target object model.

3. Payload delivery: The attacker delivers these payloads through Odoo's messaging interfaces — this includes internal messaging methods, API endpoints that route messages, or direct subversion of message processing via crafted HTTP requests containing message data structures.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class. Specific message formats, endpoint paths, and payload structures are not published.

Step 4: Arbitrary Record Creation and Privilege Escalation

Successful exploitation allows:

• Creation of arbitrary records without proper authorization — including records the user should not be able to create based on their role/group permissions.
• Privilege escalation — by crafting messages that create records in sensitive models (e.g., user accounts, group membership records, configuration records, security policy records), the attacker can escalate from a low-privileged account to a high-privileged one.

For example, an attacker might create records in models governing:

• User account attributes (e.g., increasing access rights)
• Group membership assignments
• Configuration/settings records that alter security posture

Post-Exploitation Impact

Once arbitrary record creation is achieved, the attacker can:

• Modify user group assignments to grant administrative access
• Create backdoor user accounts with elevated privileges
• Alter business records for financial gain or data manipulation
• Pivot to further attacks via newly obtained admin-level access

Impact Assessment

CVSS Score Analysis (8.1 — High)

While the full CVSS vector is not available in the provided data (listed as N/A), a score of 8.1 indicates high severity. Typical vectors for such access control flaws yield:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) — authenticated but low-privileged
• User Interaction: None (UI:N)
• Impact: High Confidentiality, High Integrity, potentially High Availability (C:H/I:H/A:H)

Business Impact

• Confidentiality: An attacker with arbitrary record creation may access or modify sensitive records, including financial data, customer information, intellectual property, and HR records. If record creation enables privilege escalation, the attacker gains full read access to all tenant data.
• Integrity: Arbitrary record creation allows injection of false or malicious business records, corrupting financial ledgers, order management, inventory systems, and CRM pipelines.
• Availability: A privileged attacker could disrupt Odoo services, delete critical records, or inject records that cause operational failures.

Affected Systems

All Odoo deployments:

• Community Edition 12.0 and earlier
• Enterprise Edition 12.0 and earlier
• Both on-premises and self-hosted installations
• Cloud deployments where the provider uses vulnerable Odoo versions

Blast Radius

The blast radius extends across the entire Odoo instance, including all interconnected business modules (Sales, Inventory, Accounting, HR, Manufacturing, CRM). Since Odoo is an integrated ERP, a single tenant compromise could expose all business data managed through the platform. Multi-tenant deployments amplify the risk — if the instance is multi-tenant, cross-tenant contamination may be possible.

EPSS Context

The EPSS score of 0.00869 (55.5% percentile) indicates that while exploitation is not currently widespread in the wild, the vulnerability is not negligible and sits around the median of known CVEs. This suggests moderate likelihood of exploitation, warranting prompt remediation.

Detection Guidance

Sigma Rule

title: Odoo Message Routing Improper Access Control Exploitation Attempt
id: 8b6f8c6d-2ec4-4a10-8e2b-8d5a5b6c7d8e
status: experimental
description: Detects suspicious message routing activity in Odoo that may indicate exploitation of CVE-2018-15645
author: ValtersIT Threat Intelligence
date: 2025/01/15
logsource:
  category: application
  product: odoo
  service: server
detection:
  selection:
    # Odoo server logs HTTP POST requests containing message routing data
    request_method: 'POST'
    referer:
      - '/web/'
    user_agent: null  # any
  keywords:
    - 'message_post'
    - 'mail.thread'
    - 'message'
    - 'notify'
  filter_known_limited:
    - response_code: 200
    - url_path:
        - '/web/dataset/call_kw'
        # Keep trusted internal calls separate
  condition: selection and keywords and not filter_known_limited
falsepositives:
  - Legitimate internal message posting from authorized admin users
  - Normal system notifications
level: medium
tags:
  - attack.initial_access
  - attack.privilege_escalation
  - cve.2018-15645

YARA Rule

rule Odoo_CVE_2018_15645_Message_Routing_Exploit
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects suspicious payloads targeting Odoo message routing access control bypass"
        date = "2025-01-15"
        cve = "CVE-2018-15645"
        reference = "NVD Description: Improper access control in message routing"
    strings:
        // Look for message routing context in payloads
        $s1 = "message_post" ascii wide
        $s2 = "mail.thread" ascii wide
        $s3 = "message_ids" ascii wide
        $s4 = "body_html" ascii wide
        $s5 = "notification" ascii wide
        // Indicators of crafted payloads attempting model creation
        $s6 = "create" ascii wide
        $s7 = "model=" ascii wide
        $s8 = "type=" ascii wide
        $s9 = "write" ascii wide
        // Suspicious privilege-related model references
        $s10 = "res.users" ascii wide
        $s11 = "res.groups" ascii wide
        $s12 = "ir.model.access" ascii wide
    condition:
        // Detect message routing operation with privilege-related model reference
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and
        (1 of ($s1, $s2, $s3)) and
        any of ($s4, $s5, $s6, $s7) and
        any of ($s10, $s11, $s12)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"Odoo CVE-2018-15645 Message Routing Access Control Bypass Attempt";
    flow:established,to_server;
    content:"POST";
    http_method;
    content:"/web/dataset/call_kw";
    http_uri;
    content:"message_post";
    http_client_body;
    nocase;
    content:"mail.thread";
    http_client_body;
    nocase;
    content:"model";
    http_client_body;
    distance:0;
    content:"create";
    http_client_body;
    distance:0;
    nocase;
    pcre:"/model\s*:\s*[\x22\x27](?:res\.users|res\.groups|ir\.model\.access)[\x22\x27]/i";
    sid:1000001;
    rev:1;
    classtype:attempted-privilege-grant;
    metadata:created_at 2025_01_15, cve CVE_2018_15645;
)

Elastic Detection

sequence by source.ip with maxspan=10m
  [network where protocol == "http" and event.action == "request" and
   url.path == "/web/dataset/call_kw" and
   request.method == "POST" and
   user.roles != "admin" and
   description like "*message_post*"]
  [file where event.action == "creation" and
   process.name : "odoo*" and
   file.name : "*.py" and
   file.path : "*models*" and
   message == "created"]

Splunk SPL Query

index=odoo sourcetype=odoo:server
| search "/web/dataset/call_kw" AND "message_post" AND "mail.thread"
| where NOT user_role IN ("admin", "system")
| eval suspicious_model = if(match(_raw, "(?i)(res\.users|res\.groups|ir\.model\.access)"), "YES", "NO")
| where suspicious_model="YES"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, user_login, url
| eval duration = last_seen - first_seen
| convert ctime(first_seen) ctime(last_seen)
| sort -count
| rename src_ip as "Source IP", user_login as "User", url as "Endpoint", count as "Attempts"

Wazuh OSSEC Rule

<rule id="100250" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/web/dataset/call_kw</field>
    <field name="method">POST</field>
    <match>message_post</match>
    <regex>model\s*:\s*["']?(?:res\.users|res\.groups|ir\.model\.access)["']?</regex>
    <description>Odoo CVE-2018-15645: Potential message routing access control bypass - privilege escalation attempt from $(srcip) for user $(user)</description>
    <group>odoo,privilege_escalation,cve_2018_15645,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source (Debian) claims a patch exists; however, this is not independently confirmed. Exercise caution and verify the patch in your environment.

1. Immediate Mitigations (Days 0-3)

1. Restrict network access: Limit access to the Odoo web interface to trusted networks and IP ranges. Use firewall rules or reverse-proxy access lists.
2. Disable self-registration: If auth_signup module is active, disable public self-registration to prevent attacker account creation.
3. Force password rotation: If there is any indication of credential exposure, force a password reset for all user accounts.
4. Enable two-factor authentication: If available, enable 2FA for all accounts, especially admin accounts.
5. Monitor for anomalous activity: Enable logging of all message routing operations and review logs daily.
6. Review user accounts: Audit existing accounts for any suspicious modification or unexpected creation.

2. Patch / Upgrade Steps

1. Verify the patch: Contact Debian security tracking or Debian security advisories for the specific patch details related to CVE-2018-15645. Confirm the patch exists and is applicable to your Odoo version.
2. Upgrade Odoo: The most reliable mitigation is to upgrade Odoo Community or Enterprise to a version later than 12.0 — specifically, to the latest stable release (e.g., 13.0 or the newest available in your support contract). Odoo releases begin at 13.0 with hardened messaging access controls.
3. Test the upgrade: Before production deployment, test the upgrade in a staging environment, verifying that existing business flows (especially messaging and notifications) work correctly.
4. Apply vendor updates: If you are on an Odoo Enterprise subscription, check the Odoo enterprise portal for any security patches specific to 12.0. Odoo typically backports security fixes to supported versions.
5. Verify after deployment: After patching/upgrading, verify via functional testing that the message routing no longer allows unauthorized record creation.

3. Long-Term Hardening

1. Maintain a patch cadence: Implement a scheduled patching cycle for Odoo updates, prioritizing security fixes.
2. Principle of least privilege: Review all user roles and group assignments in Odoo. Remove unnecessary permissions, particularly object creation rights on sensitive models.
3. Custom module audit: If you run custom Odoo modules, perform a security review with focus on message routing overrides and record creation logic.
4. Enforce strong authentication policy: Require strong passwords, implement 2FA, and consider SSO integration (OAuth, SAML).
5. Deploy a WAF: Use a Web Application Firewall with Odoo-specific rules to filter suspicious message payloads.
6. Enable comprehensive logging: Configure Odoo server logs with detailed request logging, audit trails, and model-level access logging where possible.
7. Separate environments: Ensure production, staging, and development environments are isolated, with no data crossover.
8. Vendor escalation: If using Odoo Enterprise, contact Odoo support directly to obtain the official patch for CVE-2018-15645 and confirm its applicability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2018-15645 — Official NVD description and vulnerability metadata.
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2018-15645 — Debian patch tracking page; the sole source claiming a patch exists for this CVE. Verify the status and version applicability.
3. Odoo Security Advisories: https://www.odoo.com/security — Odoo's official security advisories page. Check for any advisory concerning message routing access control issues in 12.0 and earlier versions.
4. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15645 — Cross-reference CVE data from MITRE.
5. ValtersIT Vulnerability Database (Internal): Internal assessment and threat modeling documentation for CVE-2018-15645, available to authenticated ValtersIT subscribers.

Threat Actor Campaigns

No known threat actor campaigns are documented for CVE-2018-15645 at the time of writing. The CISA KEV (Known Exploited Vulnerabilities) catalog does not include this CVE, indicating no confirmed exploitation in the wild as of the data date. However, the EPSS percentile (55.5%) suggests the vulnerability is not obscure and could be targeted by opportunistic attackers. Security teams should monitor Odoo instance logs for unusual message routing activity and remain vigilant for newly published exploit code.