CVE-2021-44461

Executive Summary

CVE-2021-44461 is a stored cross-site scripting (XSS) vulnerability residing in the Accounting application of Odoo Enterprise versions 13.0 through 15.0. The flaw permits remote attackers who possess the ability to control the contents of accounting journal entries to inject arbitrary web script that executes in the browser of a victim. Given that accounting journal entries are core financial records, any user with permission to create or modify such entries — including low-privileged accounting clerks — can leverage this flaw to target administrators or auditors viewing those records. Successful exploitation results in session hijacking, credential theft, or unauthorized financial data exfiltration within the context of the victim's Odoo session. The vulnerability carries a CVSS base score of 6.5 with a low EPSS probability of exploitation (0.00487), and is not listed on the CISA Known Exploited Vulnerabilities catalog.

Technical Analysis

The NVD description identifies this as a cross-site scripting (XSS) issue specifically within the Accounting app of Odoo Enterprise 13.0 through 15.0. The vulnerability class is stored/persistent XSS, which differs from reflected XSS in that the malicious payload is persisted on the server and later rendered to other users without validation or encoding.

The attack surface is the accounting journal entry interface. Journal entries in Odoo's Accounting module are structured financial records that can include free-text fields such as labels, references, and narration. The vulnerability mechanism, per the description, is that a remote attacker who can control journal entry contents can inject arbitrary web script. When a victim — typically an accountant, auditor, or administrator — views the affected journal entry, the embedded script executes within their browser session.

The technical details regarding the exact field names, output encoding functions, or template rendering components are not provided in the NVD data. The insufficient technical detail available makes it impossible to identify the specific parser, sanitization bypass, or rendering context vulnerable to the injection. Based on the vulnerability class, the likely root cause is improper output encoding when rendering user-supplied accounting data into HTML views. Standard Odoo views use QWeb templates; if data bound to the template is not properly escaped with the appropriate filters (such as |safe used incorrectly, or a missing |escape), the content is rendered as raw HTML.

The attack surface is authenticated but low-privileged: the attacker needs the ability to create or edit accounting journal entries. In a typical Odoo Enterprise deployment, this includes roles such as "Accounting" or "Billing" users, not necessarily administrators. The victim is any user who subsequently views the compromised journal entry — often a higher-privileged user (e.g., an Accounting Manager or administrator) since journal entries are typically reviewed by supervisors before posting.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.

Step 1 — Reconnaissance and Target Identification: The attacker first identifies an Odoo Enterprise instance running version 13.0, 14.0, or 15.0 with the Accounting app installed. This can be accomplished via HTTP fingerprinting — Odoo instances typically expose identifiable login pages and web manifest metadata. The attacker then enumerates valid user accounts via standard login mechanisms or observes organizational structure from public-facing data.

Step 2 — Triggering the Flaw: The attacker authenticates with a valid account that has permissions to create or edit accounting journal entries. This is a legitimate, low-privileged capability in most organizations. The attacker creates a new journal entry (or modifies an existing one) and inserts a malicious payload into a text field that is later rendered to other users. The payload takes the form of an HTML/JavaScript snippet, for example: <script>/* malicious code */</script> or a crafted event handler such as <img src=x onerror="/* code */">.

Step 3 — Payload Execution: When an administrator, auditor, or another accountant opens the journal entry list or detail view, the Odoo web client renders the malicious content without proper sanitization. The browser interprets the injected script in the context of the victim's Odoo session, executing it with the victim's privileges. Because the attacker controls the journal entry contents, they control the exact script executed. Common payloads include: stealing session cookies via document.cookie and exfiltrating them to an attacker-controlled server, performing state-changing operations (e.g., creating fraudulent transactions) via the victim's session, or capturing keystrokes.

Step 4 — Post-Exploitation Impact: With the victim's session compromised, the attacker gains access to all accounting data visible to that victim. If the victim is an administrator, the attacker can effectively take over the Odoo instance. Financial data exfiltration, invoice manipulation, bank account detail theft, or complete account takeover are all plausible outcomes. The persistence of the malicious payload means every subsequent view of the affected journal entry re-executes the script, creating a sustained threat.

Impact Assessment

Business Impact: The accounting module is mission-critical for financial operations. XSS in this context compromises the integrity and confidentiality of financial data. An attacker who successfully exploits this vulnerability can:

• Steal session tokens and impersonate legitimate users.
• View and exfiltrate sensitive financial records, including bank details, invoices, and tax records.
• Modify journal entries to introduce fraudulent transactions, affecting financial reporting and compliance.
• Potentially pivot to other systems if the Odoo session has integrated access (e.g., payment gateways, CRM, inventory).

CVSS Analysis: The CVSS score of 6.5 reflects a medium severity. While the attack requires authentication and specific privileges (journal entry write access), the impact on confidentiality, integrity, and availability is notable. The attack complexity is low, and exploitation does not require user interaction beyond the victim simply viewing the entry — a standard operational activity.

Affected Systems: Odoo Enterprise 13.0, 14.0, and 15.0 with the Accounting app enabled. Community edition is not explicitly listed in the NVD data; the description specifies "Odoo Enterprise."

Blast Radius: Any user with access to the Accounting app is potentially impacted, either as the attacker (journal entry editors) or the victim (journal entry viewers). In larger deployments, this could span entire finance and audit departments. The cross-tenant risk is low (single-tenant multi-company deployments are typical), but cross-company data leakage within the same instance is possible if the victim has access to multiple companies.

Detection Guidance

Sigma Rule

title: Odoo Accounting Journal Entry XSS Payload Injection
id: 2f6c3a1e-7b9d-4f2a-8c1e-9d4b5a6c7d8e
status: experimental
description: Detects potential XSS payloads in Odoo accounting journal entry creation/modification logs
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44461
tags:
    - attack.t1559
    - attack.t1190
    - cve.2021-44461
logsource:
    category: application
    product: odoo
    service: server
detection:
    selection:
        event.module: odoo
        event.action:
            - 'account.move.create'
            - 'account.move.write'
        odoo.model: 'account.move'
    keywords:
        - '*<script>*'
        - '*javascript:*'
        - '*onerror=*'
        - '*onload=*'
        - '*/><svg*'
        - '*<img*src=*'
        - '*-alert(*'
    condition: selection and keywords
    timeframe: 30s
level: high
falsepositives:
    - Legitimate use of HTML in journal entry notes (rare)
    - Users documenting HTML code in entries
fields:
    - odoo.user_id
    - odoo.move_id
    - src_ip

YARA Rule

rule CVE_2021_44461_Odoo_XSS_Payload
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects XSS payload patterns in Odoo journal entry data"
        cve = "CVE-2021-44461"
        date = "2024-01-01"
        severity = "medium"
    strings:
        $xss1 = /<script[\s>]/ nocase
        $xss2 = /onerror\s*=/ nocase
        $xss3 = /onload\s*=/ nocase
        $xss4 = /javascript\s*:/ nocase
        $xss5 = /<svg[\s>]/ nocase
        $xss6 = /<img[\s>][^>]*src\s*=/ nocase
        $xss7 = /document\.cookie/ nocase
        $xss8 = /fetch\s*\(\s*['"`]https?:/ nocase
        $xss9 = /XMLHttpRequest/ nocase
    condition:
        any of ($xss1, $xss2, $xss3, $xss4, $xss5, $xss6) and
        (any of ($xss7, $xss8, $xss9) or #xss1 > 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-44461 Odoo Journal Entry XSS Injection Attempt"; flow:established,to_server; http.request_body; content:"account.move"; sid:56461; content:"<script"; sid:56462; rev:1; classtype:web-application-attack; reference:url,nvd.nist.gov/vuln/detail/CVE-2021-44461; reference:cve,2021-44461; priority:2;)

Note: The rule above is a simplified pattern. Production-grade rules should include additional patterns for common XSS vectors and correlate with application-specific signatures.

Elastic Detection

sequence by host.name with maxspan=5m
  [network where event.type == "start" and destination.port == 443 and process.name == "nginx" or process.name == "odoo"]
  [process where event.type == "start" and process.args: "*account.move*"]
  [file where event.type == "change" and file.extension == "log" and file.path contains "odoo" and process.name == "odoo"]

Note: Since the vulnerability is stored XSS, detection at the host level is challenging. The most effective detection occurs at the application layer — monitoring for script payloads in journal entry fields via database query analytics or web application firewall (WAF) rules inspecting POST/JSON bodies to the account.move endpoints.

A more appropriate Elastic EQL approach targets application-level logging if structured logs are available:

any where event.module == "odoo" and event.action in ("create", "write")
    and odoo.model == "account.move"
    and (odoo.values contains "<script" or odoo.values contains "onerror=" or odoo.values contains "javascript:")

Splunk SPL Query

index=odoo sourcetype=odoo:server
    (action="create" OR action="write")
    model="account.move"
    (values="*<script>*" OR values="*onerror=*" OR values="*onload=*"
     OR values="*javascript:*" OR values="*<svg*" OR values="*<img*src=*")
    OR values="*fetch(*https:*"
| eval suspicious = if(match(values, "(?i)<script|onerror=|onload=|javascript:|<svg|<img"), "HIGH", "MEDIUM")
| table _time, user, src_ip, model, id, values
| sort - _time

Wazuh OSSEC Rule

<group name="odoo,">
  <rule id="100461" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.module">^odoo$</field>
    <field name="odoo.model">^account\.move$</field>
    <field name="odoo.values" type="pcre2">(?i)<script|onerror=|onload=|javascript:|<svg|<img</field>
    <description>Odoo CVE-2021-44461: Potential XSS payload in journal entry data</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>odoo_xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A single source (the CNA) claims a patch exists, but this has not been independently confirmed. The NVD data does not list a specific patched version or vendor advisory.

Immediate Mitigations (until patch is confirmed/applied)

1. Restrict journal entry write access: Limit the ability to create or modify accounting journal entries to the minimum user base required. Review Odoo user roles and remove Accounting/Billing permissions from users who do not require them.
2. Enable strict content filtering: If a web application firewall (WAF) is in place, add rules to inspect POST/JSON requests to Odoo accounting endpoints and block payloads containing script tags, event handlers, or JavaScript protocol strings.
3. Browser-side protections: Enforce a Content Security Policy (CSP) that blocks inline script execution. This can be configured via reverse proxy headers, effectively neutralizing XSS payloads that rely on inline script tags.
4. Session hardening: Reduce session lifetime and enforce re-authentication for sensitive operations within Odoo to limit the impact of session hijacking.
5. Monitor journal entry activity: Enable and monitor audit logs for account.move create/write events. Flag entries containing unusual characters (e.g., <, >, quotes in unexpected fields).

Patch/Upgrade Steps

1. Contact Odoo support directly or consult the official Odoo Enterprise changelog to obtain the specific security patch for version 13.0, 14.0, or 15.0. The CNA (Odoo) claims a fix exists, but the exact version number is not present in the NVD data.
2. Prior to patching, back up the PostgreSQL database and the Odoo file system.
3. Apply the patch in a staging environment first, testing accounting workflows thoroughly.
4. If a patched version exists (e.g., 15.0.x), upgrade to the latest available release in the 15.0 series, then consider moving to a currently supported major version.

Long-Term Hardening

1. Upgrade to a supported Odoo version: Odoo 15.0 has reached end-of-life; migrate to Odoo 17.0 or 18.0 Enterprise where this vulnerability is addressed in later, actively maintained releases.
2. Input validation and output encoding: For any custom Odoo modules, enforce strict output encoding in QWeb templates. Never render user-controlled content with |safe unless absolutely necessary, and prefer |escape or the default escapement.
3. Regular vulnerability scanning: Integrate Odoo into enterprise vulnerability management scanning to catch similar issues promptly.
4. Principle of least privilege: Conduct periodic access reviews for all Odoo roles, particularly finance-related permissions.
5. Deploy a WAF with virtual patching: Use a WAF capable of virtual patching (e.g., ModSecurity with OWASP CRS) to mitigate known vulnerabilities until patches are applied.
6. Monitor threat intelligence feeds: Continue to monitor CVE feeds for updates to CVE-2021-44461, particularly for confirmation of the patch and any emerging exploitation activity.

References

1. NVD Entry: NVD - CVE-2021-44461
2. Odoo Official Website: Odoo Enterprise Product Page — for checking supported versions and release notes for security patches.
3. Odoo Security Advisories: Odoo Security — official channel for vulnerability advisories and patch announcements.
4. MITRE ATT&CK Technique: T1190 - Exploit Public-Facing Application — relevant technique for remote exploitation of web applications.
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2021-44461 is NOT listed, indicating no confirmed exploitation in the wild as of the publication date.

Known Threat Actor Campaigns: No specific threat actor campaigns have been publicly attributed to this CVE. The EPSS score of 0.00487 (39.6th percentile) suggests a relatively low probability of exploitation in the wild; however, since the vulnerability class is well-understood XSS and the affected software (Odoo) is widely deployed in enterprises, monitoring is still advised.