CVE-2024-12368

Executive Summary

CVE-2024-12368 is an improper access control vulnerability in the auth_oauth module of Odoo Community and Enterprise version 15.0. An authenticated internal user can exploit this flaw to export the OAuth tokens of other users. This allows an attacker with low-privileged access to escalate their privileges by hijacking the OAuth sessions of higher-privileged users, potentially leading to unauthorized access to sensitive data and system functions. The vulnerability has a CVSS score of 8.1 (High), indicating significant risk. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Odoo application, which is distributed as a Python package. Organizations using Odoo 15.0 should treat this as a critical supply chain risk. The auth_oauth module is a core component, and the lack of a patch means that any deployment of Odoo 15.0 is potentially vulnerable. Administrators must monitor for official updates from Odoo and consider implementing compensating controls.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): Low - An attacker needs a valid internal user account.
• User Interaction (UI): None - No user action is required.
• Scope (S): Unchanged - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High - OAuth tokens of other users can be exposed.
• Integrity (I): None - No data integrity impact.
• Availability (A): None - No availability impact.

Threat Level: High. The low attack complexity and low privileges required make this a serious threat for any Odoo 15.0 deployment.

Deep Dive & Mechanics

The vulnerability resides in the auth_oauth module, which handles OAuth authentication. The module likely provides an endpoint or function that allows users to manage their OAuth tokens. Due to improper access control, this endpoint does not properly verify that the requesting user is authorized to access the tokens of other users.

An attacker can craft a request to this endpoint, specifying the user ID of another user, and the server will return that user's OAuth tokens. These tokens can then be used to impersonate the victim user, gaining access to their data and permissions.

The root cause is a missing or insufficient authorization check. The code likely checks if the user is authenticated but fails to verify that the user is requesting their own tokens.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern.

Vulnerable Code (Hypothetical):

# In auth_oauth/controllers.py
class OAuthController(http.Controller):
    @http.route('/auth_oauth/export_tokens', type='json', auth='user')
    def export_tokens(self, user_id):
        # Missing check: if user_id != request.env.user.id:
        tokens = request.env['auth.oauth.token'].search([('user_id', '=', user_id)])
        return tokens.read()

Patched Code (Hypothetical):

# In auth_oauth/controllers.py
class OAuthController(http.Controller):
    @http.route('/auth_oauth/export_tokens', type='json', auth='user')
    def export_tokens(self, user_id):
        # Proper access control
        if user_id != request.env.user.id:
            raise AccessError("You are not allowed to export tokens for this user.")
        tokens = request.env['auth.oauth.token'].search([('user_id', '=', user_id)])
        return tokens.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Odoo 15.0 instance with a valid internal user account.
• Knowledge of the target user's ID (can be enumerated).

Exploitation Steps:

1. Authenticate to the Odoo instance as a low-privileged user.
2. Identify the vulnerable endpoint. Based on the description, it is likely a JSON-RPC endpoint. Common patterns include /auth_oauth/export_tokens or similar.
3. Craft a request to export tokens for another user. For example:

   {
     "jsonrpc": "2.0",
     "method": "call",
     "params": {
       "service": "object",
       "method": "execute",
       "args": [
         "auth.oauth.token",
         "search_read",
         [],
         ["user_id", "=", 2]
       ]
     },
     "id": 1
   }
   

   (Note: The exact method and parameters may vary.)
4. If successful, the response will contain the OAuth tokens of user ID 2.
5. Use the stolen OAuth token to impersonate the victim user by setting it in the Authorization header of subsequent requests.

Blue Team

Detection and Prevention:

• Monitor for unusual access to OAuth-related endpoints, especially from low-privileged users.
• Implement strict access controls on all OAuth token management functions.
• Use Web Application Firewall (WAF) rules to block requests that attempt to access tokens for users other than the authenticated user.
• Enable detailed logging for all auth_oauth module actions.

Honeypot:

• Create a fake high-privilege user account with a known OAuth token. Monitor for any use of this token to detect token theft.

Indicators of Compromise (IOCs)

• Network: Unusual requests to endpoints like /auth_oauth/export_tokens or similar.
• Logs: Odoo server logs showing search_read or read operations on auth.oauth.token model by users who should not have access.
• User Behavior: A low-privileged user suddenly accessing resources or performing actions that require higher privileges.
• Token Reuse: The same OAuth token being used from different IP addresses or user agents.

Detection Engineering

YARA Rule

rule Detect_OAuth_Token_Export_Attempt {
    meta:
        description = "Detects attempts to exploit CVE-2024-12368 by searching for requests to export OAuth tokens"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12368"
    strings:
        $s1 = "auth.oauth.token" nocase
        $s2 = "search_read" nocase
        $s3 = "export_tokens" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: OAuth Token Export Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-12368 by exporting OAuth tokens of other users
author: Valters IT
date: 2024-01-01
logsource:
    category: application
    product: odoo
detection:
    selection:
        model: "auth.oauth.token"
        method: "search_read"
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12368 OAuth Token Export Attempt"; flow:to_server; content:"auth.oauth.token"; http_client_body; content:"search_read"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the auth_oauth module if OAuth is not critical to your operations.
2. Restrict access to the OAuth token management endpoints to only highly trusted users.
3. Implement a Web Application Firewall (WAF) rule to block requests that attempt to access tokens for users other than the authenticated user.

Long-term Remediation:

1. Apply the official patch once released by Odoo.
2. Upgrade to a patched version of Odoo (e.g., 16.0 or later) if possible.
3. Conduct a security audit of all custom modules that interact with OAuth tokens.

Compensating Controls:

• Monitor logs for any suspicious activity related to OAuth token access.
• Implement multi-factor authentication (MFA) to reduce the impact of token theft.
• Rotate OAuth tokens regularly and after any suspected compromise.

Valters IT
Securing Your Digital Frontier