CVE-2023-54410

Executive Summary

CVE-2023-54410 is an improper authorization vulnerability in Frappe (ERPNext/HRMS framework) before version 13.22.0. Authenticated users can rename documents they do not have permission to modify by invoking the document rename functionality, which lacks a proper permission check. This allows unauthorized modification of records, impacting data integrity within the application, though confidentiality and availability remain unaffected.

Technical Analysis

Frappe is a low-code web framework and the foundation for ERP systems such as ERPNext. Its document model allows users to rename document records (change the primary key/name) through a dedicated rename function. In versions before 13.22.0, this rename operation does not enforce the same permission checks as standard document writes or updates. Specifically, while a user may lack write or edit permissions on a given document, the rename functionality can still be invoked, allowing the document's identifier to be altered. This is a classic broken access control (CWE-285) issue: the application fails to verify that the authenticated principal has the necessary privilege to perform the rename action on the target document. The vulnerability requires authentication (PR:L) and network access (AV:N). The impact is limited to integrity (I:L) because the attacker can alter record names, potentially causing confusion, data inconsistency, or breaking references between documents. Confidentiality and availability are not directly impacted (C:N/A:N).

The exact code path is not detailed in the NVD description; however, the vulnerability class is improper authorization on a document rename endpoint. It is likely that the rename operation is exposed via a web API endpoint (e.g., /api/method/frappe.client.rename_doc) and that the permission check for rename uses a different permission model than standard document writes, or it may be bypassed by crafting requests with specific parameters. No public proof-of-concept or exploit code is available.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (improper authorization on rename functionality) and the NVD description.

1. Reconnaissance and target identification: The attacker identifies a Frappe-based application (e.g., ERPNext) by fingerprinting version information or known endpoints. They obtain valid low-privileged credentials (e.g., a standard user account) through legitimate means or social engineering.

2. Triggering the flaw: The attacker authenticates and sends a request to the document rename endpoint, specifying the target document's current name and the new name. Because the rename function does not check whether the user has write permission on the document, the operation proceeds even if the user lacks permission to modify the document.

3. Payload and execution: The payload is simply a crafted API call (e.g., HTTP POST) to the rename endpoint with parameters doctype, old_name, and new_name. No special encoding or exploitation techniques are needed; the vulnerability is a missing authorization check. The attacker can rename any document they can reach, regardless of permission.

4. Post-exploitation impact: By renaming documents, the attacker can disrupt business processes, cause confusion, or break document references. For example, renaming a critical configuration document or a customer record could lead to data integrity issues, application errors, or unauthorized changes without triggering write-permission alerts. The attacker could also rename documents to names that collide with existing ones, causing denial of service or data corruption. However, the direct impact is limited to integrity (I:L), as the attacker cannot read or delete data they do not already have access to.

Impact Assessment

The vulnerability allows authenticated users to modify the names of documents they are not authorized to modify. This can lead to data integrity issues within the Frappe application, potentially disrupting business workflows, causing application errors, or enabling further attacks through social engineering or confusion. The CVSS score of 4.3 reflects a low severity: network attack vector, low complexity, low privileges required, no user interaction, no scope change, no confidentiality impact, low integrity impact, and no availability impact. The blast radius includes any Frappe/ERPNext instance before 13.22.0 that exposes document rename functionality to authenticated users. Because the flaw is in the core framework, all applications built on Frappe may be affected. There is no evidence of active exploitation in the wild or inclusion in CISA KEV.

Detection Guidance

Sigma Rule

title: Frappe Document Rename Improper Authorization Attempt
id: 4f8c2a1e-9b3d-4c7e-8a1f-2d6e5f9c0b2a
status: experimental
description: Detects attempts to exploit CVE-2023-54410 by calling the document rename API endpoint with unusual patterns.
author: Threat Intelligence Team
date: 2025-04-09
logsource:
  category: webserver
  product: frappe
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/api/method/frappe.client.rename_doc'
  condition: selection
falsepositives:
  - Legitimate administrative actions
level: medium
tags:
  - attack.t1222
  - cve.2023.54410

YARA Rule

rule CVE_2023_54410_Frappe_Rename_Abuse
{
    meta:
        description = "Detects HTTP requests attempting to exploit Frappe rename_doc improper authorization"
        author = "Threat Intelligence Team"
        date = "2025-04-09"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-54410"
        cve = "CVE-2023-54410"
    strings:
        $rename_endpoint = "/api/method/frappe.client.rename_doc" ascii wide nocase
        $param_doctype = "doctype=" ascii wide nocase
        $param_oldname = "old_name=" ascii wide nocase
        $param_newname = "new_name=" ascii wide nocase
    condition:
        $rename_endpoint and any of ($param_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-54410 Frappe Document Rename Improper Authorization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/method/frappe.client.rename_doc"; http_uri; nocase; content:"doctype="; http_client_body; nocase; content:"old_name="; http_client_body; nocase; content:"new_name="; http_client_body; nocase; classtype:attempted-admin; reference:cve,2023-54410; sid:10000001; rev:1;)

Elastic Detection

sequence by user.name
  [ network where network.protocol == "http" and http.request.method == "POST" and url.path == "/api/method/frappe.client.rename_doc" ]

Splunk SPL Query

index=web sourcetype=access_combined
method=POST uri="/api/method/frappe.client.rename_doc" 
| stats count values(uri) as uri values(status) as status by src_ip user 
| where count > 0

Wazuh OSSEC Rule

<group name="frappe,">
  <rule id="100010" level="6">
    <decoded_as>json</decoded_as>
    <field name="url">/api/method/frappe.client.rename_doc</field>
    <description>CVE-2023-54410: Frappe document rename improper authorization attempt</description>
    <mitre>
      <id>T1222</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to the document rename API endpoint to only trusted administrative users via web application firewall (WAF) rules or reverse proxy access controls.
   • Implement custom permission checks in Frappe using hooks (e.g., override_whitelisted_methods or has_permission overrides) to enforce write permissions on rename operations.
   • Monitor for suspicious rename activities using the detection rules above.

2. Patch/upgrade steps:

   • Upgrade Frappe to version 13.22.0 or later as indicated by the NVD description. Verify that the upgrade includes a proper permission check in the rename function.
   • After upgrade, test that users without write permission cannot rename documents.

3. Long-term hardening:

   • Adopt a zero-trust approach to API authorization: every endpoint must enforce the principle of least privilege.
   • Regularly audit Frappe applications for similar authorization bypasses.
   • Implement centralized logging and monitoring for all document modification actions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-54410
• Frappe Framework GitHub: https://github.com/frappe/frappe
• CWE-285: https://cwe.mitre.org/data/definitions/285.html
• Frappe Security Advisories: https://frappe.io/security (general security page)
• No known threat actor campaigns or exploit-in-the-wild evidence at time of writing.