CVE-2021-45111

Executive Summary

CVE-2021-45111 is an improper access control vulnerability affecting Odoo Community and Odoo Enterprise versions 15.0 and earlier. The flaw permits remote authenticated users who would not normally have administration rights to trigger the creation of demonstration data within the Odoo instance. This demonstration data includes user accounts with known, hardcoded credentials, effectively granting the attacker authenticated access to a new account whose password is publicly documented.

The vulnerability is confirmed by two independent patch sources (CNA and Debian) with a high patch confidence rating of 3/4. With a CVSS score of 7.1 (High severity), this flaw represents a meaningful privilege escalation vector for authenticated attackers, potentially leading to lateral movement, data exfiltration, or full tenant compromise. No public exploit code, Nuclei template, or CISA KEV listing exists for this CVE at the time of writing, and the EPSS score of 0.00844 indicates a relatively low current exploitation probability despite the severity.

Technical Analysis

The NVD description characterizes this vulnerability as an improper access control flaw in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier. The vulnerability allows remote authenticated users to trigger the creation of demonstration data, including user accounts that ship with known credentials.

Odoo is an open-source enterprise resource planning (ERP) suite that includes CRM, e-commerce, accounting, inventory, project management, and human resources modules. Odoo's demonstration data is designed to populate the system with sample records, product catalogs, and pre-configured user accounts so that prospective customers or developers can evaluate the software's functionality in a realistic state. These demo users typically use hardcoded, publicly documented passwords (e.g., a demo administrator account with a well-known password such as "admin" or "demo"). When an attacker can force the instantiation of this demonstration data on a production instance, they gain access to accounts whose credentials are effectively public knowledge.

The vulnerability class is missing or insufficient authorization checks on a server-side action or model method responsible for initializing demonstration data. In Odoo's architecture, such an action would normally be restricted to the administrator role (i.e., users with the base.group_system or equivalent administrator group). The flaw implies that non-privileged authenticated users — perhaps those holding only portal, internal, or other low-privilege groups — are not blocked from calling the backend method that seeds the database with demo content.

Because the attack surface is the Odoo web interface and its underlying XML-RPC / JSON-RPC API, the attack requires only a valid account on the Odoo instance and knowledge of the request structure needed to invoke the relevant model method. Odoo's backend framework exposes methods to authenticated clients via RPC, which means an attacker can programmatically craft requests to the vulnerable endpoint without needing any specialized tooling beyond an HTTP client.

It should be noted that the NVD description does not specify the exact function name, URL path, or model involved. Per analysis guidance, we will not fabricate specific method names. The vulnerability mechanism is understood at the class level: insufficient server-side access control on a model method that seeds demonstration data, exploitable by any authenticated user, irrespective of intended role-based restrictions.

Exploitation Scenarios

The exploitation chain for CVE-2021-45111 is outlined below. Because no public PoC or exploit code exists, the attack chain is inferred from the vulnerability description and the Odoo feature set.

Stage 1 — Reconnaissance and Target Identification

An attacker begins by identifying Odoo instances exposed to the internet. Odoo's default web server listens on TCP port 8069, and its login page typically displays the Odoo branding. Shodan queries such as http.title:"Odoo" or product:"Odoo" can be used to enumerate candidate targets. The attacker then determines whether the target runs a vulnerable version (Community or Enterprise ≤ 15.0) by inspecting the login page footer or by making an unauthenticated request to the /web/webclient/version_info endpoint, which discloses the Odoo version.

Stage 2 — Authentication and Privilege Discovery

The attacker needs a valid account. Common approaches include: (a) purchasing or finding leaked credentials for a low-privileged user, (b) registering a new account if the Odoo instance allows self-registration (a common configuration for e-commerce or portal customers), or (c) leveraging default/weak credentials on older installations. Once logged in, the attacker verifies their current access level. The vulnerability implies that even minimally privileged authenticated users can trigger the flaw, so a portal or internal user account suffices.

Stage 3 — Triggering Demonstration Data Creation

The attacker invokes the Odoo backend action responsible for creating demonstration data. In Odoo, this is typically triggered via an RPC call to a model method that loads demo XML or CSV files into the database. The precise method name is not disclosed in the NVD description, so it is omitted here. The attacker crafts an RPC or web request (using jsonrpc or xmlrpc) that targets the method with the appropriate parameters to force the seeding of demo records. A successful trigger results in the database being populated with new records, including one or more user accounts with documented default credentials.

Stage 4 — Post-Exploitation

Once demo data is created, the attacker logs out of their low-privileged account and logs back in using one of the newly created demo accounts with its known credentials. Depending on which demo users are seeded, the attacker may obtain an administrator or high-privilege account. From this elevated vantage point, the attacker can: exfiltrate sensitive business data (financial records, customer PII, HR files), modify or destroy data, install malicious modules, pivot to other internal systems via Odoo's connected SMTP/IMAP credentials, or create additional backdoor accounts. In multi-tenant Odoo deployments, the blast radius can extend across multiple company databases if the demo seeding triggers globally.

Known Exploitation Status: No public exploit code or PoC has been released. Exploitation is a realistic threat given the simplicity of the vulnerability class, but the EPSS score of 0.00844 (placing it in the 54.7th percentile) suggests that threat actors are not actively weaponizing this CVE at the present time.

Impact Assessment

Business Impact: This vulnerability enables a low-privileged authenticated user to gain access to accounts with known credentials, including potentially administrative accounts, effectively bypassing the Odoo role-based access control model. The confidentiality impact is high because the attacker can access financial data, customer records, and proprietary business logic. The integrity impact is also high, as the demo data seeding modifies the database schema and content, and the attacker may subsequently alter or delete production data. The availability impact is low-to-moderate, stemming from potential database corruption or resource exhaustion if demo data is generated repeatedly.

CVSS Context: The CVSS score of 7.1 (High) reflects a network-exploitable vulnerability requiring low-privilege authentication. The impact subscores indicate significant confidentiality and integrity damage potential, with the attack complexity likely low and no user interaction required.

Bloom Radius (Blast Radius): In single-tenant Odoo deployments, the blast radius is limited to the Odoo application database and the accounts contained within it. However, Odoo instances frequently integrate with external services (billing gateways, email servers, FTP endpoints, other ERPs), and compromised admin credentials can be leveraged to pivot into those adjacent systems. In multi-tenant Odoo hosting environments, where one Odoo process serves multiple company databases, the impact may cross tenant boundaries depending on the data-access segregation implementation.

Affected Systems: Odoo Community 15.0 and earlier; Odoo Enterprise 15.0 and earlier. This includes on-premises deployments, self-managed cloud VMs, and containers running vulnerable versions.

EPSS Context: The EPSS probability of 0.00844 indicates that as of the scoring date, approximately 0.84% of vulnerable instances are predicted to be exploited within the next 30 days — a low but non-trivial figure, especially given that the vulnerability is trivially exploitable once an account is obtained.

Detection Guidance

The following detection rules are designed to identify exploitation attempts of CVE-2021-45111. Since no public PoC exists, detections focus on the characteristic behavior of an attacker triggering demo-data seeding: unusual RPC method calls, creation of new user accounts in rapid succession, and logins originating from the same source IP as the triggering account shortly after the seeding event.

Sigma Rule

title: Odoo Demo Data Seeding Attempt (CVE-2021-45111)
id: a1b2c3d4-1234-5678-9abc-def012345678
status: experimental
description: Detects attempts to trigger Odoo demonstration data creation by a non-privileged authenticated user, potentially exploiting CVE-2021-45111.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45111
author: Valtersit Threat Intel
date: 2025/01/01
logsource:
    category: application
    product: odoo
detection:
    selection:
        event.category: audit.log
        event.action: rpc.call
        request.method: (jsonrpc OR xmlrpc)
        request.model: (res.users OR ir.model.data)
        request.method_name: (create OR load OR update)
    condition: selection
falsepositives:
    - Legitimate administrator provisioning of demo environments
    - Development/staging instances intentionally loading demo data
level: medium
tags:
    - attack.t1098
    - cve.2021-45111

YARA Rule

rule Odoo_CVE_2021_45111_DemoData_Exploit {
    meta:
        author = "Valtersit Threat Intel"
        date = "2025-01-01"
        description = "Detects HTTP request payloads containing Odoo RPC calls to methods likely to trigger demo data creation with hardcoded credentials."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-45111"
        cve = "CVE-2021-45111"
        severity = "high"
    strings:
        $a = "prepare_demo_data" ascii nocase
        $b = "create_demo" ascii nocase
        $c = "load_demo" ascii nocase
        $d = "load_data" ascii nocase
        $e = "jsonrpc" ascii nocase
        $f = "xmlrpc" ascii nocase
        $g = "\"method\":" ascii
        $h = "demo" ascii nocase
    condition:
        (uint16(0) == 0x0D0A or uint16(0) == 0x0A0D) and
        all of ($e,$f) and
        any of ($a,$b,$c,$d) and
        $g and $h
}

Note: The YARA strings $a-$d are hypotheses based on likely Odoo method naming conventions. Since the exact method name is not disclosed in the NVD description, analysts should refine these strings if a PoC is published.

Suricata IDS Rule

alert http any any -> any any (msg:"Odoo CVE-2021-45111 - Potential Demo Data Trigger via RPC";
    flow:to_server,established;
    http.method; content:"POST";
    http.request_body; content:"jsonrpc"; nocase;
    http.request_body; content:"method"; nocase;
    http.request_body; pcre:"/(prepare_demo|create_demo|load_demo|load_data)/i";
    http.request_body; pcre:"/res\.users|ir\.model\.data/i";
    sid:5000456; rev:1;
    metadata: cve CVE-2021-45111, attack_target Odoo, deployment Perimeter, tag rpc;
    reference:url, https://nvd.nist.gov/vuln/detail/CVE-2021-45111;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [any where process.name == "odoo" and event.action == "rpc_call" and
     request.method_name like "*demo*" or request.model like "ir.model.data"]
  [any where event.action == "authentication" and user.name like "demo*" and
     source.ip == originating_source_ip]

Note: The request.method_name and request.model fields are illustrative; analysts should map them to their Odoo audit-log field names in Elastic Common Schema (ECS).

Splunk SPL Query

index=odoo_logs sourcetype=odoo:audit
| where request_method="jsonrpc" OR request_method="xmlrpc"
| search method_name=*demo* OR model="ir.model.data"
| table _time, src_ip, user_name, model, method_name, request_uri
| eventstats count as demo_trigger_count by src_ip span=5m
| where demo_trigger_count > 2
| search NOT user_name IN ("admin", "administrator")
| rename src_ip AS attacker_ip, user_name AS triggering_account
| table _time, attacker_ip, triggering_account, model, method_name, demo_trigger_count
| sort -_time

Wazuh OSSEC Rule

<group name="odoo,">
  <rule id="100456" level="10">
    <if_sid>100001</if_sid>
    <field name="model">ir.model.data</field>
    <field name="method">\.*(demo|load|create).*</field>
    <description>Odoo: Detected attempt to trigger demo data creation by non-admin user (CVE-2021-45111)</description>
    <group>cve_cve-2021-45111,</group>
    <mitre>
      <id>T1098</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (the CNA and Debian) confirm the availability of a patch. Debian's security tracker has documented the fix, and the CNA has verified it. An upgrade path exists for both Odoo Community and Enterprise.

Immediate Mitigations (without patching):

1. Restrict demo data access at the application level: In Odoo settings, ensure that the "Developer Mode" is disabled in production and that no non-admin user groups have been granted access to data-loading actions.
2. Enforce strict account creation policies: Disable self-registration (signup) on production instances to prevent anonymous attackers from obtaining low-privilege accounts. If self-registration is required for e-commerce, place the Odoo instance behind a web application firewall (WAF) and monitor new-account creation for anomalies.
3. Apply network-level restrictions: Restrict access to the Odoo XML-RPC/JSON-RPC endpoints (typically rooted at /xmlrpc/ and /jsonrpc/) to trusted IP ranges or VPN users. Public exposure significantly expands the attack surface.
4. Introduce monitoring: Activate Odoo's audit logging and feed logs into a SIEM. Create alerts for any RPC calls that reference demo-data seeds, as described in the Detection Guidance section above.

Patch/Upgrade Steps:

1. Upgrade Odoo Community: Upgrade to the latest available version greater than 15.0 (e.g., 15.0.20211201 or a later security release, or migrate to the latest stable series such as 16.0/17.0 if supported by your add-on stack). Consult the Odoo release notes for the specific security-patch commit that resolves CVE-2021-45111.
2. Upgrade Odoo Enterprise: Apply the Enterprise equivalent security patch released by Odoo S.A. Enterprise customers receive timely security updates via the Odoo support portal.
3. Debian-based installations: Update the odoo package via apt-get update && apt-get install --only-upgrade odoo. The Debian security tracker has confirmed the fix, so the patched version will be available in the debian-security repository.
4. Verify patch application: After upgrading, confirm the version string in /web/webclient/version_info reflects a version greater than 15.0 (e.g., 15.0.20211201+). If the version string remains unchanged, the patch may not have been fully applied.

Long-Term Hardening:

1. Adopt a least-privilege model: Audit all Odoo user groups and remove portal or internal access from non-essential users. Restrict administrative actions to the minimal set of users holding the settings group.
2. Deploy application-level firewalls: Use modsecurity WAF rules to filter RPC requests that target data-loading methods, and block request bodies containing demo-seeding keywords.
3. Regular security patching cadence: Subscribe to the Odoo Security Advisory mailing list and Debian security announcements. Automate patch application in staging environments before production deployment.
4. Posture review: Periodically review the user list in Odoo for unexpected accounts — particularly accounts whose login pattern matches known demo usernames (e.g., "demo", "demo_admin"). Delete any such accounts in production.

References

1. NVD Entry for CVE-2021-45111 — https://nvd.nist.gov/vuln/detail/CVE-2021-45111
2. Debian Security Tracker — CVE-2021-45111 (confirms patch) — https://security-tracker.debian.org/tracker/CVE-2021-45111
3. NVD CVSS Calculator (for CVSS 7.1 interpretation) — https://nvd.nist.gov/vuln-metrics/cvss
4. Odoo Security Advisories (vendor) — https://www.odoo.com/security
5. FIRST EPSS® for CVE-2021-45111 — https://www.first.org/epss/search?cve=CVE-2021-45111

Known threat-actor campaigns or exploit-in-the-wild evidence: None at the time of writing. CISA has not listed this CVE on the Known Exploited Vulnerabilities catalog (KEV), no public exploit code is available, and the EPSS percentile (54.7%) reflects a moderate-to-low exploitation probability. Continuous monitoring of Odoo-focused threat actors is recommended, as the low authentication barrier makes this an attractive target once a PoC becomes public.