CVE-2024-58390

Executive Summary

CVE-2024-58390 is an improper privilege management vulnerability (CWE-269) in the Frappe web framework affecting versions before 14.81.4 and 15.x before 15.41.0. An authenticated attacker holding only the low-privileged "Website User" role can abuse a specific document action—combined with additional steps—to escalate to the highly privileged "System Manager" role. Successful exploitation yields full administrative control of the Frappe application, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact.

Technical Analysis

Frappe is an open-source, low-code web application framework built on Python and MariaDB, and it powers business platforms such as ERPNext. Access control in Frappe is enforced through a role-based permission model, where document-level actions are gated by role and permission checks evaluated server-side. The "Website User" role is by design an unprivileged role used for portal and website visitors; "System Manager" is the highest-privilege role, granting administrative control over users, roles, permissions, and configuration.

CVE-2024-58390 is classified as CWE-269 (Improper Privilege Management). According to the NVD description, the flaw involves "a certain document action" that permits escalation from Website User to System Manager. The crux of the defect is that a document action—a server-side operation invoked against a specific document—fails to adequately validate that the requesting user actually possesses the privilege level the action requires, or fails to deny execution to the Website User role. Because the vulnerable operation runs with the application's server-side authority rather than strictly scoped to the caller's role, an authenticated Website User can trigger it and cause privilege changes beyond their authorization.

The vulnerability is network-exploitable (AV:N), requires no user interaction (UI:N), and requires only low privileges—the Website User role (PR:L). Complexity is low (AC:L), scope is unchanged (S:U), and the impact to confidentiality, integrity, and availability is rated High across all three (C:H/I:H/A:H), producing the 8.8 base score. The NVD description explicitly notes that the single document action must be "combined ... with additional steps" to achieve escalation, indicating a multi-stage chain rather than a one-shot privilege grant. No specific document type, endpoint, parameter, or method name is disclosed in the available intelligence, and no public proof-of-concept, Nuclei template, or exploit code exists. Consequently, the exact request sequence and the identity of the vulnerable document action cannot be stated without fabrication; the analysis must remain at the vulnerability-class level: an authorization gap in a server-side document action that a low-privileged authenticated session can reach.

Affected deployments are self-hosted or cloud-hosted Frappe and ERPNext instances running the stated version ranges and exposing authenticated portal/website access. Because the weakness is inherent to the application's permission enforcement logic rather than to a misconfiguration, merely hardening the perimeter does not remove the flaw.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (CWE-269 improper privilege management) and the NVD description. The NVD text explicitly references "a certain document action" and "additional steps," so this reconstruction stays strictly within that framing.

1. Reconnaissance / Target Identification. The attacker identifies a reachable Frappe or ERPNext instance (self-hosted or cloud) running an affected version (< 14.81.4 or 15.x < 15.41.0). Basic fingerprinting relies on framework-specific responses and default portal routes. The attacker registers or obtains a legitimate, low-privileged Website User account. Some portals allow self-registration; otherwise social engineering or a pre-existing external portal account is used. No exploit code is needed at this stage.

2. Triggering the Flaw. Authenticated as a Website User, the attacker invokes the vulnerable document action against a target document. Classification as CWE-269 means the server-side permission check governing this action is deficient: it permits a Website User session to perform an operation that should have been restricted to higher-privileged roles. The NVD description indicates that this single action alone does not complete escalation—it must be "combined with additional steps," implying the action grants an intermediate foothold (for example, a permission or assignment change) that is then leveraged in a follow-on request.

3. Execution Method (class level). The attacker sends the crafted authenticated request(s) to the Frappe server over the network, exercising the document action and the follow-on steps needed to propagate the privilege change. Because the flaw is an authorization-logic defect rather than an injection or memory-safety issue, the "payload" is simply the sequence of legitimate-looking document operations issued from a Website User session. No malformed input, memory corruption, or code injection is required; the server itself performs the privilege change because its validation is insufficient. No specific endpoint, method, or parameter is disclosed in the available intelligence, and none is invented here.

4. Post-Exploitation Impact. On success, the attacker gains System Manager privileges. With administrative authority over the Frappe application, the attacker can read and modify business records, change user accounts and role assignments, tamper with configuration and system settings, and potentially access integrated data sources, effectively compromising the confidentiality, integrity, and availability of the entire application (matching the C:H/I:H/A:H subscores). Post-escalation, an attacker would typically persist by elevating other accounts and exfiltrating sensitive business data. This is a full application-administrator compromise, not a limited data exposure.

No exploit-in-the-wild activity, CISA KEV listing, or threat-actor campaign is associated with this CVE in the provided intelligence.

Impact Assessment

The business impact is severe. Escalation from Website User to System Manager converts an untrusted external portal account into a full application administrator. The blast radius is the entire Frappe/ERPNext tenant: all business documents, customer and financial records, user accounts, role and permission configurations, and any systems or data sources integrated with the application are exposed to the attacker's administrative reach.

CVSS v3.1 base 8.8 (High) decomposes as follows: Attack Vector Network (AV:N) — remotely exploitable over HTTP(S); Attack Complexity Low (AC:L) — no special conditions beyond the multi-step chain; Privileges Required Low (PR:L) — a Website User account; User Interaction None (UI:N) — no victim action required; Scope Unchanged (S:U) — impact stays within the vulnerable component; Confidentiality/Integrity/Availability High (C:H/I:H/A:H) — full administrative control. EPSS has not been scored by FIRST.org at the time of writing, and no EPSS value should be assumed. CISA KEV does not list this CVE.

Because the vulnerability is in the authorization layer of widely deployed framework code and the prerequisites are modest (network reachability plus any Website User account), affected organizations should treat exposure seriously despite the absence of a public exploit.

Detection Guidance

Sigma Rule

title: Frappe Privilege Escalation via Document Action (CVE-2024-58390)
id: 8b6a1c2e-3f4d-4a5b-9c7e-1d2f3a4b5c6d
status: experimental
description: Detects authenticated Frappe activity consistent with abuse of a document action to escalate from Website User to System Manager (CVE-2024-58390).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-58390
author: Threat Intelligence
date: 2024-12-01
logsource:
  product: frappe
  service: application
detection:
  selection_actor:
    user_role: 'Website User'
  selection_action:
    event_type: 'document_action'
  selection_escalation:
    - message|contains: 'System Manager'
    - new_role|contains: 'System Manager'
    - role_added|contains: 'System Manager'
  condition: selection_actor and selection_action and selection_escalation
falsepositives:
  - Legitimate administrative role assignments performed by existing System Managers
level: high
tags:
  - attack.t1068
  - attack.privilege_escalation
  - cve.2024.58390

YARA Rule

rule CVE_2024_58390_Frappe_PrivEsc
{
    meta:
        description = "Detection aid for CVE-2024-58390 Frappe privilege escalation via document action"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-58390"
        date = "2024-12-01"
        cve = "CVE-2024-58390"

    strings:
        $role_website = "Website User" ascii wide nocase
        $role_sysman  = "System Manager" ascii wide nocase
        $doc_action   = "document action" ascii wide nocase
        $frappe       = "frappe" ascii wide nocase

    condition:
        $frappe and $role_website and $role_sysman
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-58390 Frappe Privilege Escalation Attempt - Website User to System Manager"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Cookie"; http.uri; content:"frappe"; content:"Website User"; nocase; content:"System Manager"; nocase; classtype:attempted-admin; reference:cve,2024-58390; sid:2024583901; rev:1;)

Elastic Detection

sequence by user.name
  [ authentication where event.action == "login" and user.roles : "Website User" ]
  [ any where event.category == "iam" and
      (event.action == "role_add" or event.action == "permission_change") and
      user.target.roles : "System Manager" ]

Splunk SPL Query

index=frappe OR index=web
| search ("Website User" AND "System Manager")
| eval suspicious=if(match(_raw,"(?i)(Website User).{0,200}(System Manager)") OR (match(_raw,"(?i)document action")),1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users values(src_ip) as src_ips by host
| sort - count

Wazuh OSSEC Rule

<group name="frappe,cve-2024-58390,">
  <rule id="20258390" level="12">
    <decoded_as>json</decoded_as>
    <field name="user_role">Website User</field>
    <match>System Manager</match>
    <description>CVE-2024-58390: Frappe Website User escalation to System Manager via document action</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references fixed versions 14.81.4 and 15.41.0, but no vendor advisory, commit, or patch artifact has been confirmed from tracked sources; validate against the upstream vendor before relying on any release as a fix.

1. Immediate Mitigations.

   • Disable or tightly restrict Website User self-registration so that untrusted parties cannot obtain the low-privileged account required for the attack. Where business needs require self-registration, gate it behind approval workflow.
   • Audit and minimize the "Website User" role: deny portal accounts any access beyond the specific documents and actions they legitimately need. Review role-permission mappings that allow Website Users to invoke document actions.
   • Treat any Website User account as untrusted. Monitor for role changes into System Manager originating from Website User sessions (see Detection Guidance).
   • Where feasible, restrict network access to the Frappe/ERPNext instance (VPN, allow-listing) to reduce the exposed attack surface.

2. Patch / Upgrade Steps.

   • Plan to upgrade to Frappe 14.81.4 (14.x branch) or 15.41.0 (15.x branch). Because patch confidence is 0/4, verify the fix through the upstream project's release notes and repository before deployment; do not assume the release is validated by this report.
   • Test upgrades in a staging environment, given heavy customization common to Frappe/ERPNext deployments, and confirm that only intended documents/actions are affected.
   • After upgrading, rotate credentials and re-audit all accounts, especially any that were granted System Manager unexpectedly.

3. Long-Term Hardening.

   • Enforce least privilege for all portal and website roles; periodically review role-permission matrices for drift.
   • Implement robust monitoring of privilege-changing operations and alert on any Website User to System Manager transition.
   • Apply defense in depth: WAF rules, network segmentation, and central log aggregation for the Frappe application.
   • Track upstream Frappe security advisories and subscribe to release notifications so future privilege-management flaws are patched promptly.

References

• NVD — CVE-2024-58390: https://nvd.nist.gov/vuln/detail/CVE-2024-58390
• Frappe Framework / Frappe Technologies (project home and release notes): https://frappeframework.com
• CWE-269: Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2024-58390 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2024-58390 in the provided intelligence.