CVE-2021-44460

Executive Summary

CVE-2021-44460 is an improper access control vulnerability affecting Odoo Community 13.0 and earlier, as well as Odoo Enterprise 13.0 and earlier. The flaw allows users whose accounts have been deactivated to retain access to the system by submitting crafted RPC (Remote Procedure Call) requests, thereby bypassing the intended account-deactivation control. A successful exploit grants the attacker continued access with all permissions still associated with the deactivated account, potentially leading to data exfiltration, unauthorized modification of business-critical data, or lateral movement within the Odoo deployment. The vulnerability carries a CVSS score of 7.4 (High severity), and while no public exploit or CISA KEV listing exists, the risk is significant given Odoo's widespread use in enterprise ERP environments.

Technical Analysis

The vulnerability resides in the authentication and session-management layer of Odoo's XML-RPC and JSON-RPC interfaces. When an administrator deactivates a user account, the expected behavior is that the account immediately loses the ability to authenticate — including through Active Directory, LDAP, database credentials, or any other configured authentication backend. However, CVE-2021-44460 indicates that this control is not properly enforced for RPC-based access.

The root cause is an access-control logic flaw: the system fails to re-validate account status (active/deactivated) during the processing of RPC requests that carry a previously established session or credential token. The NVD description states that "users with deactivated accounts [can] access the system with the deactivated account and any permission it still holds, via crafted RPC requests." This implies that the deactivation flag is checked only during certain authentication flows — likely session establishment — but not during subsequent RPC invocations.

Technically, Odoo's RPC layer (use of the jsonrpc and xmlrpc controllers) typically validates the session ID (sid) or the db, login, and password triplet on each call. The bug allows a crafted RPC request — possibly one that replays a stale session token, modifies a user-status field in the call payload, or exploits a race condition — to bypass the deactivation check. The phrase "crafted RPC requests" suggests that normal HTTP requests are blocked, but a specially constructed request (e.g., one that modifies the active flag in the user context, or that uses a legacy authentication header) can slip through the validation process.

Because both Odoo Community and Enterprise 13.0 are affected, the flaw sits in core authentication code shared across editions, not in a commercial-only module. The attack surface is the publicly exposed RPC endpoints (typically /web/session/authenticate, /xmlrpc/2/common, /xmlrpc/2/object), which are commonly reachable on standard Odoo installations (port 8069 or through reverse proxies).

Vulnerability Class and Mechanism

The vulnerability class is Improper Access Control (CWE-284). Specifically, it is a failure to enforce a security invariant (account active status) across all application entry points. The mechanism is: deactivated user → crafted RPC request → server processes request without checking activation status → request succeeds with the user's retained permissions.

Exploitation Scenarios

The following attack chain is inferred from the NVD description. No public PoC, exploit code, or Nuclei template is currently available; details are presented at the vulnerability-class level.

Step 1 — Reconnaissance and Target Identification.
An attacker first identifies an Odoo instance. This is trivial using Shodan or Censys (searching for http.title:"Odoo" or the Odoo login page), or by scanning for port 8069 (default Odoo web port). The attacker then needs valid credentials for a user account — either by using previously compromised credentials (e.g., from a breach of a related database service) or by social engineering an employee. The attacker does not necessarily know whether the account has been deactivated; the vulnerability makes the deactivation irrelevant.

Step 2 — Triggering the Flaw.
Once the attacker holds valid credentials (username/password for an Odoo user), they craft an RPC request. The exact payload structure is undocumented in public sources, but the class of attack involves invoking the authentication or object-execute method via the RPC API with parameters that cause the server to skip the active-user check. For instance, the attacker might replay a previously captured session ID from before the deactivation, or send an authentication request with a context parameter that overrides the user-status check.

Step 3 — Payload / Execution Method.
At the vulnerability-class level, the attacker sends a crafted XML-RPC or JSON-RPC call to an exposed endpoint. The request attempts to authenticate as the deactivated user or invokes a method using that user's session context. Because the server fails to enforce the active flag on this request path, the server responds as if the user were fully active, returning a valid session or executing the requested business method.

Step 4 — Post-Exploitation Impact.
With a valid session, the attacker can now invoke any business method the deactivated account was permitted to run. This includes, but is not limited to: reading or modifying sales orders, customer records, invoices, purchase orders, HR data, or manufacturing bills of materials. If the deactivated account had high privileges (e.g., was formerly an administrator), the attacker gains full ERP-level control. The attacker can also create new accounts, disable audit logs, or exfiltrate data over a long period. The deactivation event that was supposed to revoke access provides no protection, making this a persistent-access threat.

Important Note: Insufficient technical detail is available in the NVD description to specify the exact RPC method names or parameter structures. The attack chain above is inferred from the vulnerability class (improper access control in RPC authentication) and Odoo's known architecture. No public PoC exists, and no exploit-in-the-wild activity has been reported.

Impact Assessment

Confidentiality Impact (High): A deactivated user with read permissions can continue to access all data the account could see before deactivation. In ERP systems, this includes customer PII, financial records, and business secrets.

Integrity Impact (High): If the deactivated account had write or create permissions, the attacker can modify orders, change prices, delete records, or alter configuration — actions that can be extremely damaging to business operations.

Availability Impact (Low): The flaw itself does not enable denial-of-service, but an attacker could use the access to trigger resource-intensive operations or lock out legitimate users by modifying their accounts.

Affected Systems: All Odoo Community and Enterprise installations running version 13.0 or earlier. This includes on-premises deployments and self-hosted instances. Odoo Online (Odoo's SaaS offering) is presumably patched by the vendor, but on-prem customers must apply the fix themselves.

Blast Radius: The CVSS v3 score of 7.4 (High) with the vector "N/A" in the provided data reflects a significant but not critical risk. The probability of exploitation in the wild is low per EPSS (0.00687), and the CVE is not listed in CISA KEV as of this report. However, the true risk depends on how many employees have left a company without their Odoo accounts being permanently deleted — deactivation is the common interim step.

Business Impact: ERP data corruption, compliance violations (GDPR/similar), financial fraud, and reputation damage. The vulnerability undermines a critical security control: deactivation of departing employees or compromised accounts.

Detection Guidance

Detection of this vulnerability's exploitation is challenging because the attacker uses legitimate credentials and the session is indistinguishable from a normal active-user session — the only difference is that the account flag is active = false. Detection should focus on anomalous activity from accounts that should have zero activity.

Sigma Rule

title: Odoo RPC Activity from Deactivated Account
id: a1b2c3d4-1111-2222-3333-444444444444
status: experimental
description: Detects successful Odoo RPC requests originating from user accounts flagged as inactive/deactivated.
author: Valters IT Security
logsource:
    category: application
    product: odoo
detection:
    selection:
        event.action: 'login'
        result: 'success'
    filter_user_status:
        # This field is populated from the Odoo user record in the request context
        user.is_active: 'false'
    condition: selection and not filter_user_status
    # NOTE: Detection requires Odoo application logs to include the 'active' flag
    # or integration with a SIEM that can cross-reference accounts.
level: high
falsepositives:
    - Legitimate session reuse during account reactivation by an administrator
    - Session previously established before deactivation

YARA Rule

rule Odoo_RPC_Deactivated_Account_Access
{
    meta:
        author = "Valters IT Security"
        description = "Detects crafted RPC requests targeting Odoo that bypass the active-user check"
        cve = "CVE-2021-44460"
        date = "2024-01-01"
    strings:
        $xmlrpc = "xmlrpc/2/object" ascii nocase
        $jsonrpc = "web/session/authenticate" ascii nocase
        $active_false = "\"active\":false" ascii nocase
        $active_false2 = "active=False" ascii nocase
        $login_method = "execute_kw" ascii nocase
        $user_model = "res.users" ascii nocase
    condition:
        ($xmlrpc or $jsonrpc) and ($active_false or $active_false2) and 1 of ($login_method, $user_model)
        // Based on known Odoo request structures; requires logging HTTP bodies.
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2021-44460 - Odoo RPC Deactivated Account Bypass Attempt"; flow:established,to_server; http.uri; content:"/xmlrpc/2/object"; nocase; http.uri; content:"/web/session/authenticate"; pcre:"/(execute_kw|authenticate).*(active.*false|false.*active)/i"; classtype:attempted-admin; sid:2021444601; rev:1; reference:cve,CVE-2021-44460;)

Elastic Detection

// EQL query - requires HTTP request body logs captured
sequence by request_id
  [ any where process.name == "httpd" or true ]
  [ any where true ] // placeholder for HTTP request body containing RPC call
;
// Alternative: filter on user context
any where event.action == "login" and user.id in ( SELECT id FROM users WHERE active == false )

Splunk SPL Query

index=odoo_web_logs sourcetype=access_combined
| spath input=message
| where like(message, "%active%")
| regex message="(active.*false|false.*active)"
| regex message="(execute_kw|authenticate)"
| table _time, src_ip, uri_path, message
| search NOT `known_legit_active_user`
| stats count by src_ip, uri_path
| where count > 5

Wazuh OSSEC Rule

<group name="odoo,">
  <rule id="100460" level="12">
    <decoded_as>json</decoded_as>
    <field name="log_type">odoo_rpc</field>
    <match>xmlrpc/2/object</match>
    <regex>active.*false</regex>
    <description>Odoo RPC request referencing inactive user flag - potential CVE-2021-44460 exploitation</description>
    <group>access_control, odoodetection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (the CNA and the Debian security tracker) confirm that a fix exists. However, the vendor advisory and exact patched version number are not provided in the available data.

1. Immediate Mitigations (until patched):

   • Disable RPC for external access. If business continuity allows, block all external access to /xmlrpc/* and /web/session/authenticate at the WAF or firewall level. Internal-only access reduces the attack surface significantly.
   • Review and purge deactivated accounts. Periodically audit res.users records where active = False. As an interim control, delete deactivated accounts entirely (rather than merely deactivating them) if legal/regulatory constraints permit.
   • Enable MFA for all accounts that have RPC access, if the Odoo version supports it — this raises the bar even if the deactivation bypass is used.
   • Restrict RPC permissions via Odoo's "External API" access groups. Limit which users have the "External API" or "JSON-RPC" access right to a minimum.

2. Patch/Upgrade Steps:

   • Upgrade to Odoo 13.0 + latest patch — The vendor has released a corrective patch; the CNA and Debian both confirm it. Apply the patch immediately. The exact commit or patch version is not listed in the available data, so check the Odoo changelog for version 13.0 and later.
   • If you are on an older version (< 13.0), plan an upgrade to 13.0 (patched) or a later version (14.0, 15.0, 16.0). Upgrading directly to a version with the fix is the only guaranteed remediation.
   • For Debian-based installations, monitor the Debian security tracker for the odoo package update and apply it promptly.

3. Long-Term Hardening:

   • Segment the Odoo database from other internal systems, and restrict the Odoo web server's outbound connections to prevent lateral movement if an account is compromised.
   • Implement SIEM integration for Odoo application logs, specifically tracking login events, RPC calls, and res.users modification events.
   • Adopt a zero-trust model for privileged accounts: deactivated accounts should be deleted after a short grace period, not left inactive indefinitely.
   • Regularly audit effective access rights (Odoo's "Access Rights" report) to ensure no deactivated user retains unusual permissions.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-44460
2. Odoo Security Advisory (via CNA disclosure) — consult https://www.odoo.com/security for the official patch details.
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2021-44460
4. Odoo Releases/Changelog (for patched version specifics): https://www.odoo.com/documentation/13.0/releases/
5. CISA KEV Catalog: Not listed (as of report date) — consult https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: As of this writing, no known exploitation campaigns, ransomware operators leveraging this CVE, or public exploit code have been reported. The EPSS score of 0.00687 (49.4th percentile) suggests low immediate exploitation probability, but the high CVSS score and the prevalence of Odoo in small-to-medium business ERP deployments warrant proactive patching.