CVE-2021-23203

Executive Summary

CVE-2021-23203 is an improper access control vulnerability in the reporting engine of Odoo Community and Enterprise editions, versions 14.0 through 15.0. A remote, unauthenticated attacker can exploit this flaw to download PDF reports for arbitrary documents within the Odoo instance, leading to unauthorized disclosure of potentially sensitive business data. The vulnerability carries a CVSS score of 7.5 (High) and is confirmed patched by both the CNA and Debian security trackers, although no public exploit code or CISA KEV listing has been identified at the time of writing.

Technical Analysis

The vulnerability resides in the reporting engine component of Odoo, which is responsible for generating PDF reports from various business documents (e.g., invoices, purchase orders, delivery notes, quotes). The flaw is classified as an improper access control issue (CWE-284), meaning that the reporting engine fails to adequately verify whether the requesting user has the necessary permissions to view the underlying document data before generating and serving the PDF report.

Odoo's reporting engine typically relies on server-side record access rules defined per user role and company. In a properly configured system, the engine should only render reports for documents that the authenticated user has explicit access to. However, in affected versions (14.0 through 15.0), the access control checks within the reporting engine can be bypassed through crafted requests. This suggests that the engine processes report generation requests without consistently validating the requester's read permissions against the target record, or that certain report templates are exposed without proper authorization gateways.

The attack surface is the Odoo web interface itself, specifically the HTTP endpoints that handle report download requests. These endpoints are accessible from the network, typically on port 8069 (default Odoo HTTP port) or via reverse-proxied HTTPS configurations. Because the vulnerability lies in the authorization logic rather than in memory corruption or injection, exploitation does not require any prior authentication — the NVD description explicitly states "remote attackers" can trigger the flaw, implying no valid session is needed.

The impact is confidentiality-focused: an attacker can enumerate or guess document identifiers (which in Odoo are typically sequential integer IDs or record references) and request PDF reports for documents they should not be able to view. This includes documents belonging to other tenants in a multi-tenant deployment, or restricted documents within an organization.

Insufficient technical detail is available to identify the exact vulnerable function names or URL paths. The NVD description does not specify the precise endpoint or code-level mechanism. However, based on the vulnerability class, the flaw most likely involves a missing or incomplete check_access_rights call (or equivalent) prior to rendering the report.

Exploitation Scenarios

Based strictly on the vulnerability class (improper access control in a report generation engine) and the NVD description, the likely attack chain is as follows:

1. Reconnaissance / Target Identification: The attacker identifies an Odoo instance (version 14.0 through 15.0) exposed to the internet. This can be done via Shodan queries for Odoo favicon hashes, title tags, or by fingerprinting the /web/login page which is characteristic of Odoo installations. The attacker may also enumerate the Odoo version via HTTP headers or login page metadata.

2. Triggering the Flaw: The attacker crafts an HTTP request directed at the Odoo reporting engine endpoint that handles PDF report generation. The request includes parameters that reference a specific document ID (e.g., an invoice, purchase order, or other business record) and specifies the desired report template. No authentication token or session cookie is supplied, or a low-privilege session is used. Because the access control check is insufficient, the server processes the request and generates a PDF report for the referenced document.

3. Payload / Execution Method (vulnerability-class level): The attacker iterates through sequential document IDs to enumerate various business records. Since the report engine fails to enforce read-access permissions, each crafted request returns a PDF containing the contents of the target document. This is a direct HTTP request manipulation attack — no code execution is involved, but the confidentiality boundary is crossed.

4. Post-Exploitation Impact: The attacker gains access to sensitive business documents — invoices (including customer financial data), purchase orders, internal notes, delivery orders, and potentially personnel-related records. Depending on the Odoo modules installed, this could include HR documents, project data, or other confidential information. The attacker can aggregate these documents for financial intelligence, competitive espionage, or further targeted attacks (e.g., CEO fraud using obtained invoice and vendor data).

No public PoC is available; the above attack chain is inferred from the vulnerability class and NVD description. The lack of authentication requirements makes this a straightforward exploit for any attacker with network access to the Odoo instance.

Impact Assessment

The CVSS score of 7.5 (High) reflects a network-exploitable vulnerability requiring no authentication and no user interaction. The primary impact is confidentiality: the vulnerability enables unauthorized disclosure of arbitrary document data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates:

• Attack Vector: Network — exploitable remotely.
• Attack Complexity: Low — no special conditions required.
• Privileges Required: None — unauthenticated exploitation.
• User Interaction: None.
• Scope: Unchanged — the vulnerable component is the affected system.
• Confidentiality Impact: High — significant data exposure.
• Integrity/Availability Impact: None.

Business Impact: For enterprises running Odoo, this vulnerability exposes core business data. Financial documents (invoices, bills), supply chain information (purchase orders, vendor records), and customer data may be disclosed. This could trigger regulatory compliance failures (e.g., GDPR for personal data, SOX for financial records), loss of competitive advantage, and reputational damage. In multi-tenant Odoo deployments (e.g., SaaS providers hosting multiple customer instances), the blast radius expands — an attacker could potentially access reports across all tenants.

Affected Systems: All Odoo Community and Enterprise deployments running versions 14.0 through 15.0. This includes on-premises installations, Docker containers, and Odoo Online (the provider-managed cloud offering) during the affected version window.

Blast Radius: Any document with an associated PDF report template is potentially exposed. Given that Odoo ships with report templates for standard business documents (sales orders, invoices, delivery notes, etc.), the exposure is broad across any installed module.

Detection Guidance

Sigma Rule

title: Odoo Unauthenticated PDF Report Access Attempt (CVE-2021-23203)
id: 3f2e8f7a-9b4c-4d5e-8f1a-2c3d4e5f6a7b
status: experimental
description: Detects attempts to download PDF reports from Odoo without authentication, indicating possible exploitation of CVE-2021-23203.
logsource:
  category: webserver
  product: nginx
  definition: 'Requirements: access logs from reverse proxy in front of Odoo'
detection:
  selection:
    http.url|contains:
      - '/report/pdf/'
      - '/report/download/'
    http.status_code: 200
  filter_authenticated:
    http.url|contains:
      - '?session_id='
      - '&session_id='
  condition: selection and not filter_authenticated
fields:
  - source.ip
  - http.url
  - http.user_agent
falsepositives:
  - Users with valid sessions accessing reports without session_id in URL (if session cookies are used instead)
level: high

YARA Rule

rule CVE_2021_23203_Odoo_Report_Access
{
    meta:
        author = "ValterSec TRT"
        description = "Detects HTTP requests targeting Odoo report endpoints without authentication"
        reference = "CVE-2021-23203"
        date = "2025-01-25"
        version = "1.0"
    strings:
        $report_endpoint_1 = "/report/pdf/" ascii nocase
        $report_endpoint_2 = "/report/download/" ascii nocase
        $report_endpoint_3 = "report" ascii nocase
        $odoo_identifier = "Odoo" ascii nocase
        $no_session_1 = "session_id" ascii nocase
        $no_session_2 = "token" ascii nocase
        $response_pdf = "%PDF" ascii
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A and
        any of ($report_endpoint_*) and 
        $odoo_identifier and
        not any of ($no_session_*) and
        $response_pdf
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SERVER Odoo Unauthenticated PDF Report Access (CVE-2021-23203)"; flow:established,to_server; content:"GET"; http_method; content:"/report/pdf/"; http_uri; nocase; content:"/"; http_uri; distance:0; content:"?"; http_uri; distance:0; content:!"session_id"; http_uri; distance:0; sid:202123203; rev:1; reference:cve,2021-23203; classtype:attempted-recon; metadata:created_at 2025_01_25, updated_at 2025_01_25;)

Elastic Detection

sequence by process.pid
  [network where destination.port == 80 or destination.port == 443 and
   network.protocol == "http" and
   url.path : ("/report/pdf/*", "/report/download/*") and
   not url.query : "*session_id*" and
   not url.query : "*token*"]
  [network where destination.port == 80 or destination.port == 443 and
   network.protocol == "http" and
   http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| search "/report/pdf/" OR "/report/download/"
| where NOT uri_query LIKE "%session_id%" AND NOT uri_query LIKE "%token%"
| stats count by src_ip, uri, status, user_agent
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="odoo,">
  <rule id="100233" level="10">
    <decoded>json</decoded>
    <match>\/report\/pdf\/|\/report\/download\/</match>
    <description>Odoo PDF report endpoint accessed - possible CVE-2021-23203 exploitation</description>
    <group>cve-2021-23203,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — The fix is confirmed by two independent sources (CNA and Debian security tracker), giving high but not absolute confidence that the vulnerability is fully remediated in the patched releases.

1. Immediate Mitigations (if patch cannot be applied):

   • Restrict network access to the Odoo instance: place it behind a VPN or IP allowlist. Only allow trusted IP ranges to reach the web interface.
   • If Odoo is behind a reverse proxy (nginx, Apache), implement an access control rule that blocks requests to /report/pdf/ and /report/download/ paths unless an authenticated session token is present in the request.
   • Monitor access logs for anomalous patterns: bursts of PDF downloads, requests with sequential IDs, or requests to these endpoints without session identifiers.
   • Disable PDF report generation if not essential to business operations.

2. Patch / Upgrade Steps:

   • Upgrade to a fixed Odoo version. For Odoo Community and Enterprise, apply the latest maintenance release of version 15.0 or later. For deployments still on 14.0, upgrade to the 14.0 latest patch release that includes the fix.
   • Verify the installed version via the Odoo backend or odoo --version on the server.
   • After upgrade, verify that PDF report generation requires proper authentication and access control enforcement.
   • Test report generation with a non-privileged user account to ensure access control is working.

3. Long-Term Hardening:

   • Follow Odoo's official security advisories and subscribe to the Odoo security announcements mailing list.
   • Implement robust logging and alerting for sensitive endpoints. Use the detection rules provided above to build proactive monitoring.
   • Conduct regular penetration testing of the Odoo instance, specifically targeting report generation and other data-export endpoints.
   • Ensure the Odoo application runs with least-privilege database credentials, minimizing the potential data exposure if the app is compromised.
   • Consider a Web Application Firewall (WAF) with virtual patching capability if appliance-based controls are part of the security stack.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-23203
2. Odoo Security Advisory (via CNA): https://github.com/odoo/odoo (connection failed — verify manually)/security/advisories (referencing CVE-2021-23203)
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2021-23203
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: No known threat actor campaigns have been publicly attributed to CVE-2021-23203. The EPSS score of 0.00875 (55.6% percentile) suggests a low but non-zero probability of exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code or Nuclei template has been identified at the time of writing. However, given the low exploitation complexity and the sensitive nature of the data exposed (financial documents), organizations running affected Odoo versions should prioritize patching despite the lack of public exploit evidence.