CVE-2021-45111
📋 TL;DR
This vulnerability allows authenticated remote users in Odoo to trigger the creation of demonstration data, including user accounts with known credentials. This affects Odoo Community and Enterprise versions 15.0 and earlier. Attackers can gain unauthorized access through these pre-configured accounts.
💻 Affected Systems
- Odoo Community
- Odoo Enterprise
📦 What is this software?
Odoo by Odoo
Odoo by Odoo
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts with known credentials, leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Attackers create standard user accounts with known credentials to access sensitive business data and perform unauthorized operations.
If Mitigated
With proper access controls and monitoring, impact is limited to demonstration data creation that can be detected and cleaned up.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Odoo 15.0+ (post 15.0 release with fix)
Vendor Advisory: https://github.com/odoo/odoo/issues/107683
Restart Required: No
Instructions:
1. Upgrade to Odoo version 15.0+ with the security fix. 2. Apply the patch from the Odoo repository. 3. Verify the fix by checking version and testing the vulnerability.
🔧 Temporary Workarounds
Restrict User Permissions
allLimit authenticated users' permissions to prevent them from triggering demonstration data creation.
Configure Odoo user roles to remove unnecessary privileges
Disable Demonstration Data Feature
allDisable the demonstration data creation functionality if not required.
Modify Odoo configuration to disable demo data features
🧯 If You Can't Patch
- Implement strict access controls and monitor for unauthorized user creation.
- Regularly audit user accounts and remove any demonstration or unknown accounts.
🔍 How to Verify
Check if Vulnerable:
Check Odoo version; if 15.0 or earlier, it is vulnerable. Test authenticated access to demo data creation features.Check Version:
Check Odoo web interface or configuration files for version number.Verify Fix Applied:
After patching, attempt to trigger demonstration data creation as an authenticated user; it should fail.📡 Detection & Monitoring
Log Indicators:
- Log entries showing demonstration data creation
- Unexpected user account creation events
Network Indicators:
- HTTP requests to demo data endpoints from authenticated users
SIEM Query:
Search for Odoo logs with 'demo' or 'create' actions by non-admin users.