CVE-2023-40954
📋 TL;DR
A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (web_progress) Odoo module allows remote attackers to execute arbitrary SQL commands via the recency parameter. This can lead to privilege escalation, data theft, or complete system compromise. Affects all users running vulnerable versions of this Odoo module.
💻 Affected Systems
- Grzegorz Marczynski Dynamic Progress Bar (web_progress) Odoo module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover via SQL injection leading to remote code execution, data exfiltration, and lateral movement within the Odoo environment.
Likely Case
Privilege escalation allowing attackers to gain administrative access to Odoo, modify data, and potentially access sensitive business information.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented, with database permissions restricted to minimum necessary privileges.
🎯 Exploit Status
Public exploit code is available in the OdZoo repository. The vulnerability requires minimal technical skill to exploit due to the straightforward SQL injection vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after the commit 3c867f1cf7447449c81b1aa24ebb1f7ae757489f
Vendor Advisory: https://github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f
Restart Required: Yes
Instructions:
1. Update the web_progress module to the latest version from the official repository. 2. Restart the Odoo service. 3. Verify the fix by checking that the recency parameter is properly sanitized.
🔧 Temporary Workarounds
Disable web_progress module
allTemporarily disable the vulnerable module until patching is possible
odoo-bin -d your_database --stop-after-init -i base --update web_progress
Web Application Firewall rule
allBlock requests containing SQL injection patterns targeting the recency parameter
🧯 If You Can't Patch
- Implement strict input validation for the recency parameter in the web_progress module
- Apply network segmentation to isolate Odoo instances and restrict database access
🔍 How to Verify
Check if Vulnerable:
Check if the web_progress module is installed and if the version falls within the vulnerable range. Examine the models/web_progress.py file for lack of parameterized queries on the recency parameter.Check Version:
Check Odoo module version via Odoo interface: Settings → Apps → Find web_progress moduleVerify Fix Applied:
Verify that the commit 3c867f1cf7447449c81b1aa24ebb1f7ae757489f is applied in your web_progress module. Test that SQL injection attempts on the recency parameter are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful admin access
- Requests containing SQL injection patterns in recency parameter
Network Indicators:
- Unusual outbound database connections from Odoo server
- Traffic patterns matching known SQL injection payloads
SIEM Query:
source="odoo.log" AND ("recency" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE" OR "--" OR "'"))🔗 References
- https://github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f
- https://github.com/luvsn/OdZoo/tree/main/exploits/web_progress
- https://github.com/gmarczynski/odoo-web-progress/commit/3c867f1cf7447449c81b1aa24ebb1f7ae757489f
- https://github.com/luvsn/OdZoo/tree/main/exploits/web_progress
