CVE-2021-26263

Executive Summary

CVE-2021-26263 is a stored Cross-Site Scripting (XSS) vulnerability in the Discuss chat/discussion module of Odoo Community and Enterprise editions, affecting versions 14.0 through 15.0. A remote unauthenticated attacker can exploit this issue by posting crafted content to the Discuss application, resulting in arbitrary script execution within the context of a victim's browser when they view the malicious message. With a CVSS score of 7.5, the vulnerability enables session hijacking, credential theft, defacement, and potentially account takeover of authenticated Odoo users, making it a significant threat to organizations running exposed Odoo instances.

The vulnerability exists in the data handled by the Discuss module and does not require authentication to inject the malicious payload, though user interaction (viewing the crafted content) is required for successful exploitation. Patches are available and confirmed by two independent sources (CNA and Debian), though no public proof-of-concept or exploit code has been observed in the wild as of the latest assessment. The EPSS score (0.00557) suggests low current exploitation probability, but the prevalence of Odoo deployments in enterprise environments warrants immediate attention.

Technical Analysis

The Odoo Discuss application provides real-time messaging, channel-based communication, and direct messaging functionality within the Odoo framework. The vulnerability class is stored Cross-Site Scripting (XSS), which occurs when user-supplied input is insufficiently sanitized before being rendered in the browser of another user.

From the NVD description, the attack surface is the content posting mechanism within the Discuss app. The description specifically states: "allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents." This indicates that:

1. Attack Vector: Network-based (AV:N) — the attack can be carried out remotely without any special network access requirements.
2. Attack Complexity: Low (AC:L) — no special conditions or race conditions are needed to exploit the flaw.
3. Privileges Required: None (PR:N) — the attacker does not need to authenticate before delivering the payload. However, the description notes the payload executes "in the browser of a victim," implying the victim must be an authenticated user viewing the malicious content.
4. User Interaction: Required (UI:R) — a victim must view the crafted content for script execution.
5. Scope: Changed (S:C) — the injected script executes in a context that can potentially impact resources beyond the vulnerable component's security boundary, enabling actions as the victim user.
6. Confidentiality Impact: High (C:H) — successful exploitation can lead to complete disclosure of accessible data, including session tokens, private messages, and business records.
7. Integrity Impact: None (I:N) per the CVSS score indication, though it should be noted that XSS typically allows actions that modify data on behalf of the victim.
8. Availability Impact: None (A:N).

The vulnerability mechanism is typical of stored XSS: an attacker crafts a message containing malicious script, posts it to a Discuss channel, direct message thread, or discussion board, and when any user views that content, the script executes in their browser session context. Since the Discuss module is tightly integrated with the broader Odoo framework, the injected script would run in the authenticated session of the viewing user, granting the attacker the ability to perform any action that the victim user can perform.

Insufficient technical detail is available in the NVD description regarding the exact input handling mechanism, sanitization failure point, or the specific content types involved. No function names, class names, or API endpoints are disclosed in the available data. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which encompasses both reflected and stored XSS variants.

The affected product line includes:

• Odoo Community 14.0 through 15.0
• Odoo Enterprise 14.0 through 15.0

This spans two major release branches, indicating the vulnerability was present for at least one full release cycle before discovery.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2021-26263 at the time of this report. The attack chain described below is inferred from the vulnerability class (stored XSS in a chat/discussion application) and the NVD description context.

Step 1: Reconnaissance and Target Identification

An attacker scans for internet-exposed Odoo instances, typically identified via Shodan queries such as http.title:"Odoo" or through port scanning for common Odoo web interfaces. The attacker verifies the version is within the vulnerable range (14.0 through 15.0) by examining the login page footer, static asset fingerprints, or API responses. Odoo's Discuss module is enabled by default in the standard installation.

Step 2: Crafting and Delivering the Malicious Payload

The attacker accesses the public-facing Odoo instance and navigates to the Discuss application. Since the vulnerability is accessible to remote attackers without authentication (as indicated by PR:N in the CVSS vector), the attacker can post content to the application. In many Odoo configurations, certain Discuss channels or public discussion boards may be accessible without authentication, or the attacker may register a low-privilege account if self-registration is enabled.

The attacker crafts a message containing malicious HTML/JavaScript embedded within the content body. The payload is designed to be unobtrusive so it does not raise suspicion when rendered. Typical payloads for stored XSS in chat applications include:

• <script> tags containing JavaScript (if script tags are not filtered)
• Event handler attributes (e.g., onmouseover, onload) on HTML elements
• javascript: protocol URLs in anchor or iframe elements
• SVG-based payloads or other HTML5 vector vectors

The crafted message is submitted to the Discuss module, where it is stored in the application's database. The message may be posted to a public channel, a direct message to a specific target, or a group discussion.

Step 3: Script Execution

When a victim user opens the Discuss application and views the channel or conversation containing the malicious message, the Odoo web interface renders the stored content without adequate sanitization. The malicious script executes in the context of the victim's browser session, inheriting the victim's authentication cookies and session tokens for the Odoo instance.

Step 4: Post-Exploitation Impact

A successful exploitation enables the attacker to:

• Session Hijacking: Steal session cookies and impersonate the victim in future requests.
• Account Takeover: Perform password changes, modify profile settings, or escalate privileges.
• Data Exfiltration: Access private messages, customer records, invoices, inventory data, and any business data the victim can access.
• Lateral Movement: If the Odoo instance integrates with other enterprise systems (ERP modules, CRM, email, payment gateways), the attacker may leverage the victim's session to pivot to connected systems.
• Financial Fraud: In Odoo Enterprise deployments handling sales orders, purchases, and invoices, an attacker could manipulate business records or initiate unauthorized transactions.
• Persistent Presence: The stored payload persists in the Discuss database, affecting all users who view the content over time.

The exploit requires no special network positioning, making any internet-facing Odoo instance a potential target for this attack vector.

Impact Assessment

Business Impact: CVE-2021-26263 carries a CVSS score of 7.5 (High severity), driven primarily by the Network attack vector (AV:N), Low attack complexity (AC:L), no privileges required (PR:N), and High confidentiality impact (C:H). The vulnerability can be weaponized with minimal technical skill, and the stored nature of the payload ensures it can affect multiple users over an extended period.

Affected Systems: All Odoo Community and Enterprise installations running versions 14.0 through 15.0 are potentially vulnerable. Given Odoo's popularity as an open-source ERP platform, this encompasses a wide range of organizations including small-to-medium businesses, e-commerce operations, manufacturing firms, and service providers.

Blast Radius: The scope of impact is significantly expanded by the Changed scope (S:C) component of the CVSS vector. While the vulnerable component is the Discuss module, the injected script executes in the broader Odoo application context. This means an attacker can perform actions across the entire Odoo platform using the victim's privileges, not just within the messaging subsystem. Critical business data — customer information, financial records, supply chain data, human resources records — becomes accessible depending on the victim's role.

Confidentiality Impact (High): The primary impact is data confidentiality. A successful XSS attack can capture sensitive information displayed in the victim's browser, extract tokens, and obtain full access to the victim's session.

Integrity Impact (Noted but Not in CVSS): Though the CVSS vector suggests no integrity impact, XSS exploitation typically enables data modification. The attacker can submit forms, create or edit records, or change system configuration on behalf of the authenticated victim.

Exposure Context: The 43.5% EPSS percentile is moderately elevated, suggesting some attention toward this vulnerability in the threat intelligence community, though no active exploitation campaigns have been publicly documented. The lack of CISA KEV inclusion indicates no confirmed nationwide exploitation.

Detection Guidance

The following detection rules focus on identifying both the malicious payload submission and the subsequent suspicious behavior after successful XSS exploitation.

Sigma Rule

title: Odoo Discuss Module Stored XSS Payload Submission Attempt
id: 3b8a9e2c-7f4d-4a91-b6e2-c5d7a1f8e9b3
status: experimental
description: Detects attempts to submit crafted content containing potential XSS payloads to the Odoo Discuss module
author: valtersit.com Threat Intelligence
date: 2024/01/15
logsource:
  category: webserver
  product: odoo
  service: accesslogs
detection:
  selection_login:
    http.url_path|contains:
      - '/discuss'
      - '/mail/message'
      - '/mail/channel'
  selection_post:
    http.method: 'POST'
  selection_payload_keywords:
    http.request_body|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - '<svg'
      - '<iframe'
      - '<img src=x onerror='
  selection_attributes:
    http.request_body|contains:
      - 'body='
      - 'content='
      - 'message='
  condition: selection_login and selection_post and selection_payload_keywords and selection_attributes
  level: high
  falsepositives:
    - Developers testing chat functionality with HTML formatting
    - Legitimate use of HTML formatting in administrative discussions
fields:
  - client.ip
  - http.url_path
  - http.user_agent
  - http.request_body

YARA Rule

rule Odoo_Discuss_XSS_Payload_2021
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects XSS payload strings commonly used against Odoo Discuss module"
        reference = "CVE-2021-26263"
        date = "2024-01-15"
        severity = "high"
        cve = "CVE-2021-26263"
    strings:
        $xss_script = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on(error|load|mouseover|click|focus|blur)\s*=\s*["']?javascript:/i
        $xss_svg = /<svg[^>]*onload\s*=\s*[^>]*>/i
        $xss_iframe = /<iframe[^>]*src\s*=\s*["']javascript:/i
        $xss_img = /<img[^>]*src\s*=\s*["']?[^"']*["']?[^>]*onerror\s*=\s*/i
        $xss_obfuscated = /(?:&#x?[0-9a-fA-F]+;|\\x[0-9a-fA-F]{2})+(?:alert|document\.cookie|fetch|XMLHttpRequest)/i
        $odoo_context = /(?:discuss|mail\.message|mail\.channel|partner_id|thread_id)/i
    condition:
        uint16(0) == 0x4D5A or filesize < 200KB and
        (2 of ($xss_*) and $odoo_context)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Odoo Discuss Stored XSS Payload Attempt (CVE-2021-26263)"; flow:established,to_server; content:"POST"; http_method; content:"/discuss"; http_uri; nocase; content:"<script"; http_client_body; nocase; classtype:web-application-attack; sid:202126301; rev:1; reference:cve,2021-26263; priority:1;)

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Odoo Discuss XSS via Event Handler (CVE-2021-26263)"; flow:established,to_server; content:"POST"; http_method; content:"/mail/"; http_uri; nocase; pcre:"/on(?:load|error|mouseover|focus|click)\s*=\s*[^\s>]{1,200}/i"; classtype:web-application-attack; sid:202126302; rev:1; reference:cve,2021-26263; priority:1;)

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Odoo Discuss Embedded Script/Iframe (CVE-2021-26263)"; flow:established,to_server; content:"POST"; http_method; content:"/discuss"; http_uri; nocase; content:"<iframe"; http_client_body; nocase; content:"javascript:"; http_client_body; nocase; classtype:web-application-attack; sid:202126303; rev:1; reference:cve,2021-26263; priority:1;)

Elastic Detection

any where process.name == "nginx" or process.name == "httpd"
  // Filter for Odoo Discuss endpoints
  and url.path in ("/discuss", "/mail/message", "/mail/channel")
  // POST requests carrying potential XSS content
  and http.request.method == "POST"
  // Look for common XSS vectors in the request body
  and (
    wildcard(http.request.body.content, "*<script*") or
    wildcard(http.request.body.content, "*javascript:*") or
    wildcard(http.request.body.content, "*onerror=*") or
    wildcard(http.request.body.content, "*onload=*") or
    wildcard(http.request.body.content, "*onmouseover=*") or
    wildcard(http.request.body.content, "*<svg*") or
    wildcard(http.request.body.content, "*<iframe*") or
    wildcard(http.request.body.content, "*<img*src=*onerror=*")
  )

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/discuss" OR uri_path="/mail/*" 
  method="POST"
  | rex field=_raw "\"(?<body>[^\"]*)\"\s*\d+\s*$"
  | where like(body, "%<script%") OR like(body, "%javascript:%") 
    OR like(body, "%onerror=%") OR like(body, "%onload=%") 
    OR like(body, "%onmouseover=%") OR like(body, "%<svg%") 
    OR like(body, "%<iframe%")
  | eval threat="Odoo_Discuss_XSS_Attempt", cve="CVE-2021-26263"
  | table _time, src_ip, useragent, method, uri_path, body, threat, cve
  | sort - _time

Wazuh OSSEC Rule

<group name="odoo,">
  <rule id="100261" level="10">
    <if_sid>31100</if_sid>
    <field name="url">\.discuss|mail\.message|mail\.channel</field>
    <field name="http_method">POST</field>
    <match>javascript:|&lt;script|onerror=|onload=|onmouseover=|&lt;svg|&lt;iframe</match>
    <description>Odoo Discuss module XSS payload injection attempt (CVE-2021-26263)</description>
    <group>attack,xss,odoo,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  
  <rule id="100102" level="8">
    <if_sid>100101</if_sid>
    <match>alert|prompt|confirm|document\.cookie|fetch\(|XMLHttpRequest</match>
    <description>Odoo Discuss XSS execution behavior observed in web logs (CVE-2021-26263)</description>
    <group>attack,xss,odoo,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 3/4 (LIKELY), with two independent sources (CNA and Debian) confirming the availability of fixes.

1. Immediate Mitigations (to apply before patching):

• Disable or restrict access to the Discuss module: If the Discuss application is not business-critical, disable it via Odoo's module management interface or restrict network access to the /discuss endpoints using web application firewall (WAF) rules.
• Deploy WAF rules: Configure a WAF to inspect POST requests to Discuss endpoints for common XSS payload signatures (<script, javascript:, event handlers) and block or flag suspicious requests.
• Enforce strict CSP headers: Add a Content Security Policy that blocks inline scripts and script-src from non-allowlisted domains, which can mitigate XSS even if payload injection succeeds.
• Disable self-registration: If Odoo's self-registration portal is enabled, disable it to reduce the ability of unauthenticated attackers to create accounts for payload delivery.

2. Patch/Upgrade Steps:

• Upgrade to patched version: For Odoo Community and Enterprise, upgrade to the latest 15.0.x release which fixes CVE-2021-26263. For 14.0 installations, apply the available backported fix.
• Debian-based distributions: For Debian-packaged Odoo instances, apply the security update from the Debian security repository: apt-get update && apt-get upgrade odoo.
• Odoo.sh and SaaS customers: Odoo Online customers received the fix as part of the automatic update process — no action required.
• Custom deployments: After upgrading, verify that no custom modules overwrite the patched internal components, and retest Discuss functionality.

3. Long-Term Hardening:

• Regular security patching: Establish a regular patching cycle for Odoo updates to ensure rapid adoption of security fixes.
• Input validation and output encoding: Ensure any custom modules built on top of Odoo properly sanitize user input and encode output, particularly where user content is rendered in HTML.
• Network segmentation: Place Odoo instances behind a reverse proxy with WAF capabilities and restrict direct internet exposure through firewall rules.
• Web application security testing: Perform periodic penetration tests and automated vulnerability scanning of Odoo endpoints, with particular focus on authenticated modules like Discuss that handle user-generated content.
• Session security: Enable HttpOnly and Secure flags on all session cookies to mitigate the impact of successful XSS exploitation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-26263 — Official NVD record containing the vulnerability description and CVSS scoring.
2. Odoo Security Advisory: https://www.odoo.com/security — Vendor advisory portal (registration may be required for full disclosure details).
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2021-26263 — Debian-specific patch information and package updates for Odoo.
4. MITRE CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26263 — CVE record with cross-referenced enumeration data.
5. EPSS Data: https://www.first.org/epss/ — Exploit Prediction Scoring System data confirming current threat intelligence context.

Threat Actor Campaigns: No public documentation of active exploitation campaigns, ransomware gang activity, or state-sponsored use of CVE-2021-26263 was identified at the time of this report. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the stored XSS nature of the vulnerability makes it a common target for commodity automated attack tools and opportunistic attackers scanning for internet-facing Odoo instances. Organizations should not assume safety based on the absence of public exploit reports; the 43.5% EPSS percentile suggests elevated community interest in the vulnerability.