CVE-2021-44775

Executive Summary

CVE-2021-44775 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in the Website application module of Odoo Community 15.0 and earlier, as well as Odoo Enterprise 15.0 and earlier. The flaw enables a remote, unauthenticated attacker to inject arbitrary web script into the browser of a victim by posting crafted content through the website's public-facing input mechanisms. Successful exploitation results in script execution within the victim's authenticated Odoo session context, potentially leading to session hijacking, account takeover, data exfiltration, or administrative compromise if the victim has elevated privileges. The vulnerability carries a CVSS score of 6.5 and has two independent patch confirmations, but no public exploit code has been identified at the time of this writing.

Technical Analysis

The vulnerability resides in the Website app module of Odoo — the component responsible for building and rendering public-facing websites, blogs, event pages, and e-commerce storefronts. Odoo's Website module allows users (including unauthenticated visitors, depending on configuration) to submit content through forms, comment sections, contact pages, and blog comment systems.

The attack mechanism is a classic lack of input sanitization on server-side rendering. When a remote attacker submits crafted content (e.g., HTML fragments containing <script> tags, event handler attributes such as onerror, or malicious SVG/iframe payloads), the Odoo server does not adequately encode or neutralize the payload before storing it and later rendering it to other site visitors.

Because Odoo templates often insert user-generated content into the page DOM without context-aware output encoding, the stored payload executes when a victim's browser parses the page containing the malicious content. Given that the Website app is public-facing by design, this vulnerability is exploitable by pre-authentication attackers, making it particularly dangerous for community-hosted instances.

The attack class is XSS (CWE-79), specifically stored (persistent) XSS, though the NVD description does not explicitly rule out a reflected variant depending on the specific input vector used. No function names, URL endpoints, or code-level specifics were disclosed in the advisory, so the precise input sanitization point within the module remains undocumented in public sources. Unvalidated data flows from the request parameter layer directly into the HTML template layer through the QWeb templating engine.

It is worth noting that no EPSS or KEV data indicates active in-the-wild exploitation; the EPSS percentile of 43% suggests moderate attention from the security research community but no confirmed mass exploitation campaigns.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC or exploit code has been released, and specific implementation details (function names, API routes) are not disclosed.

Step 1 — Reconnaissance and Target Identification: An attacker scans for exposed Odoo instances using search engines or Shodan with queries targeting Odoo's distinctive login pages, website footers, or the presence of /web/login and /website paths. The target is any Odoo Community or Enterprise instance running version 15.0 or earlier with the Website app enabled.

Step 2 — Triggering the Flaw: The attacker navigates to a public page on the target website that accepts user-submitted content — for example, a blog comment form, a contact form, a product review field, or a testimonial submission page. The attacker submits a POST request containing a malicious payload embedded in the content field. Because the Website module either fails to sanitize the input server-side or stores it raw, the payload is persisted in the Odoo database associated with the victim site.

Step 3 — Payload Execution: The payload is crafted at the vulnerability-class level — for instance, an HTML script tag: <script>/* malicious JavaScript */</script>, or an event-based trigger such as <img src=x onerror="/* code */">. When any user (including the site administrator) visits the page where the crafted content is rendered, the browser executes the embedded JavaScript in the context of the victim's Odoo session.

Step 4 — Post-Exploitation Impact: The injected script can:

• Exfiltrate session cookies or CSRF tokens, enabling session hijacking.
• Make authenticated API requests to the Odoo backend, including creating new admin users.
• Modify website content (defacement).
• Redirect victims to phishing pages.
• Perform silent data harvesting from any content visible in the victim's dashboard.

Because PR:N (no privileges required) and the scope is changed (S:C), the attacker does not need to authenticate to plant the payload, and the impact extends beyond the vulnerable web component into the victim's broader Odoo session and data.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

CVSS Context: The base score of 6.5 reflects medium severity. Vector components indicate:

• Network attack vector (AV:N) — exploitable remotely.
• Low attack complexity (AC:L) — no special conditions required.
• No privileges required (PR:N) — unauthenticated exploitation.
• User interaction required (UI:R) — victim must browse to the affected page.
• Changed scope (S:C) — the compromised component (Website module) impacts resources beyond its security authority (the victim's broader Odoo session and data).
• Low confidentiality and integrity impact (C:L/I:L) — partial data access and modification possible.

Business Impact:

• Brand damage: Public-facing pages used for social engineering or site defacement erode customer trust.
• Account compromise: Administrators browsing the site are prime targets; session theft can lead to full platform takeover.
• Regulatory exposure: If the Odoo instance processes personal data (e.g., e-commerce, HR modules), a successful XSS could lead to data breaches requiring notification under GDPR or similar frameworks.
• Supply-chain risk: Odoo is often deployed on-premise or in private clouds; a compromised instance can provide a pivot point into internal networks.

Blast Radius: All Odoo instances (Community and Enterprise) up to and including 15.0 are affected. Instances with the Website app enabled and public comment/form submission are at immediate risk. Instances behind strict WAFs with aggressive content filtering may see reduced exploitability, but no built-in Odoo mitigation exists for the stored payload.

Detection Guidance

The following detection artifacts target the network and host-based signatures of XSS payloads commonly used to exploit stored XSS in CMS-like platforms. Since the exact parameter names are unknown, the rules focus on generic XSS indicators in web traffic and on Odoo-specific response patterns.

Sigma Rule

title: Odoo Website Stored XSS - CVE-2021-44775
id: <generate-uuid>
status: experimental
description: Detects HTTP requests to Odoo Website app containing XSS indicators in POST bodies or query strings.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44775
tags:
    - attack.t1059.007
    - cve.2021.44775
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection_xss_indicators:
        cs-method: POST
        cs-uri-extension:
            - '/website/*'
            - '/blog/*'
            - '/contactus/*'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '<iframe'
        cs-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '%3Cscript%3E'
    condition: selection_xss_indicators
fields:
    - clientip
    - cs-host
    - cs-uri-stem
falsepositives:
    - Legitimate content submissions containing HTML in code examples (rare)
level: high

YARA Rule

rule oddoo_stored_xss_cve_2021_44775 {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects XSS payload signatures in web request bodies targeting Odoo Website module"
        cve = "CVE-2021-44775"
        severity = "high"
        date = "2025-04-11"
    strings:
        $a = /<script[\s>]/ nocase
        $b = /on(error|load|click|mouseover)\s*=/ nocase
        $c = /javascript\s*:/ nocase
        $d = /<iframe[\s>]/ nocase
        $e = /%3Cscript%3E/i
        $f = /document\.cookie/ nocase
        $g = /fetch\s*\(|XMLHttpRequest|\.ajax\(/ nocase
    condition:
        uint16(0) == 0x0D0A and any of ($a,$b,$c,$d) and 1 of ($e,$f,$g)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-44775 Odoo Website Stored XSS Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/website/"; http_uri; nocase; content:"<script"; http_client_body; nocase; sid:10004475; rev:1; metadata:created_at 2025_04_11, updated_at 2025_04_11, cve CVE-2021-44775;)

Elastic Detection

// Detect POST requests to Odoo website module with XSS signatures
sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method == "POST" and
   http.request.body.content like "*<script*"]
  [network where network.protocol == "http" and http.request.body.content like "*onerror=*" or 
   http.request.body.content like "*onload=*" or http.request.body.content like "*javascript:*"]
  [process where event.type == "start" and process.name : ("chrome", "firefox", "msedge") and 
   process.command_line like "*odoo*"]

Splunk SPL Query

index=web sourcetype=access_combined 
| where method="POST" 
| search uri_path IN ("/website/*", "/blog/*", "/contactus/*") 
| rex field=_raw "body\.(?<request_body>.*)" 
| eval xss_indicators=if(match(request_body, "(?i)(<script|onerror=|onload=|javascript:|<iframe)"), "ALERT", "OK")
| where xss_indicators="ALERT" 
| table _time, clientip, uri_path, request_body 
| stats count by clientip, uri_path

Wazuh OSSEC Rule

<rule id="100475" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <description>CVE-2021-44775 - Odoo Website Stored XSS payload detected</description>
    <field name="method">POST</field>
    <regex>(\/website\/|\/blog\/|\/contactus\/)</regex>
    <regex>((<script)|(onerror\s*=)|(onload\s*=)|(javascript\s*:)|(<iframe))</regex>
    <group>attack.xss, cve, oddoo, web_attack</group>
    <mitre>
        <id>T1059.007</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY. Two independent sources (CNA and Debian) confirm a fix exists.

Immediate Mitigations (if patching is not immediately possible):

1. Disable public form/comment submission on the Website app temporarily via Odoo's settings (Website → Configuration → Website Settings → disable comments/posts) until the patch is applied.
2. Deploy a Web Application Firewall (WAF) rule set that blocks request bodies containing <script, onerror=, onload=, or javascript: strings before they reach the Odoo server.
3. Restrict internet exposure of the Odoo web interface; place the Website module behind a VPN or access control list wherever business logic permits.
4. Monitor logs for the Sigma/Suricata rules above; escalate any hits for immediate review.

Patch & Upgrade Steps:

1. Identify current version: python3 odoo-bin --version or check Odoo menu → About.
2. Upgrade to the latest 15.0 release that includes the fix. As of this report, apply all subsequent maintenance releases for the 15.0 series. For 14.0 and earlier, upgrade to a supported version (e.g., 15.0+ or 16.0) that incorporates the security fix.
3. Verify the patch: After upgrade, audit the Website app's rendering logic to confirm input is sanitized via mark_safe is removed from user-content paths and that QWeb auto-escaping (|safe filters) is not applied to user-generated fields.
4. Test the instance: Submit a benign <script> payload in a test comment/post; verify it is rendered as text, not executed.

Long-Term Hardening:

• Enable Content Security Policy (CSP) headers in the Odoo reverse proxy (nginx/apache) to restrict script sources to trusted domains.
• Enable HttpOnly and Secure flags on Odoo session cookies (session_id) in the Odoo configuration file.
• Implement CSP nonce-based script allowlisting for any remaining inline scripts.
• Conduct periodic security code reviews of custom modules interacting with the Website app.
• Subscribe to the Odoo Security Advisories mailing list for future patch notifications.
• Maintain a vulnerability management program that includes automated scanning of Odoo instances against the NVD feed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-44775 — Official CVE description and CVSS scoring.
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2021-44775 — Independent patch confirmation and affected package details.
3. Odoo Security Advisories: https://www.odoo.com/security — Vendor advisory page (patch released for 15.0+).
4. MITRE ATT&CK: https://attack.mitre.org/techniques/T1059/007/ — Technique mapping for JavaScript execution.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirmed as NOT listed; no evidence of active exploitation in the wild as of this report.

No known threat actor campaigns or exploit-in-the-wild evidence has been publicly documented for CVE-2021-44775 as of the publication date. The EPSS score of 0.00545 (43rd percentile) suggests limited observed scanning or exploitation activity.