CVE-2021-23166

Executive Summary

CVE-2021-23166 is a server-side sandboxing bypass vulnerability in Odoo Community and Enterprise editions up to version 15.0. An authenticated user with administrator privileges can exploit this flaw to read and write arbitrary local files on the server filesystem, leading to potential remote code execution, data exfiltration, or complete server compromise. The vulnerability has a critical CVSS score of 8.7, and while no active exploitation has been reported to CISA KEV, the high privileges required imply a post-authentication attack chain.

Technical Analysis

The NVD description indicates that Odoo's built-in sandboxing mechanism fails to properly isolate file system operations initiated by authenticated administrators. Odoo frequently uses Python's built-in sandboxing libraries (such as pysandbox or restricted exec environments) to limit the operations that custom code or certain system actions can perform. The flaw is that the sandbox can be escaped due to incomplete enforcement of filesystem access restrictions.

Vulnerability Mechanism: The sandbox is intended to intercept and deny file-system operations outside of designated directories. However, an attacker with admin rights can leverage Odoo's legitimate file-handling features (e.g., custom report templates, database backup/restore, import/export functions, or web asset management) to pass filesystem paths that bypass the sandbox's filters. This is generally achieved through path traversal or by abusing the underlying Python runtime-level escape methods (e.g., subprocess or dynamic module loading) that the sandbox fails to account for.

Attack Surface: The Odoo web interface exposes admin-only endpoints for module installation, email gateway configuration, and scheduled actions, among others. The most probable attack surface is the custom report/barcode/session handling or the "Technical Settings" panel, where administrator privileges allow unrestricted file path inputs. Because the vulnerability is in the sandboxing layer itself, all Odoo 15.0 and earlier versions are affected regardless of deployment (on-premise, Docker, or PaaS).

Code-Level Explanation: The exact vulnerable function is not disclosed in the NVD description. However, the vulnerability class is that of an insecure sandboxing implementation — the security layer relies on an allowlist of functions but fails to block certain Python built-ins (e.g., open, file read/write) when invoked through indirect references or with specially crafted path arguments. This is similar to classic Python sandbox escapes (e.g., using ().__class__.__bases__[0].__subclasses__() to access file objects) — a pattern commonly exploited in Jinja2 template injection or restricted Python exec.

Exploitation Scenarios

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker identifies an Odoo instance reachable over the internet (via Shodan or direct scanning for the Odoo login page). The attacker must obtain or already possess valid administrator credentials, either through phishing, credential stuffing, or by compromising a lower-privileged account and escalating via other Odoo misconfigurations.

Step 2 — Triggering the Flaw: Once authenticated as an administrator, the attacker navigates to a feature that accepts a filesystem path as input — most commonly found in "Settings > Technical > Actions > Scheduled Actions" or "Accounting > Configuration > Settings" for custom report output paths. The attacker supplies a path that bypasses the sandbox, either via absolute paths outside the allowed root (e.g., /etc/passwd or ../../../../etc/shadow) or uses relative path traversal combined with symlink attacks.

Step 3 — Payload/Execution: At the vulnerability-class level, the attacker crafts an input that causes Odoo's Python backend to execute a file read or write operation outside the intended sandbox directory. For write operations, the attacker could write a malicious Python module into Odoo's addons directory that gets auto-loaded on the next server restart, or overwrite an existing Python file to inject arbitrary code. For read operations, sensitive files such as database configuration (odoo.conf), SSH keys, or environment variable files can be read directly from the web response.

Step 4 — Post-Exploitation: Upon successfully reading server files, the attacker obtains database credentials, SMTP relay credentials, or application secrets, enabling deeper internal lateral movement. If file write is achieved, the attacker gains Remote Code Execution (RCE) as the service account running Odoo (typically a non-root user but often with access to the database server via sockets), leading to data theft, ransomware, or pivot into the internal network.

Impact Assessment

Confidentiality: The ability to read local files means any file accessible to the Odoo process user is exposed. This includes configuration files with database passwords, email service credentials, and potentially customer data stored in configuration backups. CVSS "High" confidentiality impact.

Integrity: File write access allows the attacker to overwrite application code, templates, or system files. An attacker could backdoor the application permanently, modify report templates to include malicious payloads for downstream users, or alter audit logs. CVSS "High" integrity impact.

Availability: While the CVSS vector (as approximated) does not list a direct availability impact, a malicious actor could render the Odoo instance inoperable by deleting critical files or overwriting them with malformed data. In many sandbox-escape scenarios, RCE leads to full server takeover and service disruption. The base CVSS score 8.7 reflects the critical nature of the combined read/write capability.

Affected Systems: All on-premise Odoo Community and Enterprise deployments running versions 14.0, 13.0, 12.0 (under LTS support) and earlier, up to the 15.0 release. Hosted/Cloud Odoo Online customers (run by Odoo S.A.) are patched server-side; self-hosted installations require manual patching.

Blast Radius: Because file write can lead to RCE with service-account privileges, the blast radius extends beyond the Odoo application to the entire hosting server and any network resources accessible via that service account (e.g., database server, shared mounts, internal APIs).

Detection Guidance

Given the limited technical detail publicly available, detection rules focus on anomaly patterns: unusual file path operations by admin users, directory traversal indicators, and file write operations outside expected web-root directories. These are realistic generic detection rules for this vulnerability class.

Sigma Rule

title: Odoo Sandbox Escape - Unusual File Access Paths
id: 481d0c9e-8a69-4f17-ae25-6f0b71a54112
status: experimental
description: Detects Odoo processes accessing files outside the expected application directory, potentially indicating CVE-2021-23166 sandbox escape.
tags:
    - attack.privilege_escalation
    - attack.t1068
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/odoo-bin'
        CommandLine|contains:
            - '/etc/shadow'
            - '/root/.ssh'
            - '/proc/self/environ'
            - '../..'
            - '.pyc'
    condition: selection
    timeframe: 15m
level: high
falsepositives:
    - Legitimate admin maintenance tasks using backup tools

YARA Rule

rule Odoo_Sandbox_Escape_File_Access
{
    meta:
        author = "Valters IT SOC"
        description = "Detects Odoo log strings indicative of sandbox escape attempts (path traversal or file read beyond root)."
        date = "2025-01-01"
        reference = "CVE-2021-23166"
        score = 70

    strings:
        $path_escape1 = "../../"
        $path_escape2 = "..\\"
        $file_read = "/etc/passwd"
        $file_read2 = "FILE_READ"
        $file_write = "FILE_WRITE"
        $sandbox_error = "AccessDenied"
        $sandbox_error2 = "SandboxException"

    condition:
        any of ($file_*) or any of ($path_escape*) or any of ($sandbox_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-23166 - Odoo Sandbox Escape Directory Traversal"; flow:established,to_server; content:"/web/database/backup"; http.uri; content:"..%2f"; http.uri; nocase; content:"/etc/"; http.uri; nocase; within:200; classtype:attempted-admin; sid:20252316; rev:1; metadata:created_at 2025_01_01, updated_at 2025_01_01, cve CVE-2021-23166;)

Elastic Detection

sequence by host.name with maxspan=10m
  [process where event.type == "start" and process.name == "odoo-bin" and
   process.args : ("/web/database/backup", "/web/database/restore")]
  [file where event.type == "creation" and file.path not like "*/odoo/*" and
   file.path like ("*/etc/*", "*/var/lib/*", "*/home/*")]

Splunk SPL Query

index=linux sourcetype=syslog process=odoo-bin
| rex field=process_command "(?<filepath>/[^\s]+\.(py|conf|txt|log))"
| where filepath != "*/odoo/*"
| stats count by src_ip, user, filepath
| where count > 20

Wazuh OSSEC Rule

<group name="odoo,">
  <rule id="100231" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">odoo-bin</field>
    <regex>\.\./.*\.(conf|py|txt)|/etc/passwd|/etc/shadow</regex>
    <description>Odoo sandbox escape attempt detected - unusual file path access</description>
    <mitre>
      <id>T1068</id>
      <id>T1213</id>
    </mitre>
    <group>odoo_exploit,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Note: Only one source (Debian) claims a patch exists; this is unconfirmed by the vendor's official advisory. Security teams should treat this as "patch may or may not be fully available" and apply defense-in-depth measures regardless.

1. Immediate Mitigations (do these now):

   • Restrict administrator account access to only trusted, IP-allowlisted personnel. Enforce MFA on all Odoo admin accounts.
   • If possible, revoke write access for the Odoo system user on the web root and configuration directories: chown root:root /path/to/odoo/custom_addons and set file permissions to read-only.
   • Place Odoo behind a reverse proxy (nginx/Apache) with a WAF rule blocking directory traversal patterns (../, encoded /etc/, etc.).
   • Isolate the Odoo server in a restricted network segment — block outbound internet access unless required.

2. Patch/Upgrade Steps:

   • Check the Debian security tracker for an updated odoo package (apt-cache policy odoo-current). If available, update: sudo apt update && sudo apt upgrade odoo-current odoo.
   • If no Debian package exists, upgrade to the latest Odoo 15.0 release (15.0.20220510 or later if released) or the 16.0 release stream, which is outside the vulnerable range.
   • Verify the sandbox fix by attempting to read /etc/passwd via a scheduled action in the admin panel — if blocked, patch is effective.

3. Long-Term Hardening:

   • Run Odoo under a dedicated non-privileged service account with no sudo access.
   • Containerize Odoo (Docker) with a read-only root filesystem and strict filesystem volumes.
   • Enable SELinux/AppArmor profiling for the Odoo process to deny writes outside specified directories.
   • Regularly review admin users; remove unused accounts; rotate credentials quarterly.
   • Subscribe to Odoo's security announcements and the Debian security mailing list for the earliest patch notifications.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-23166
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2021-23166
3. Odoo Community Forums (related discussion): https://www.odoo.com/forum/help-1
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2021-23166 not currently listed, indicating no confirmed in-the-wild exploitation per CISA.

Threat Actor Activity: As of the writing of this report, no specific threat actor campaigns have been publicly attributed to CVE-2021-23166. EPSS score of 0.00649 indicates a low probability of active exploitation (47.7% percentile). However, the vulnerability class is well-understood and likely incorporated into private exploit toolkits targeting ERP systems. Monitor Odoo server logs for unusual admin API calls and file path anomalies.