CVE-2024-12368
📋 TL;DR
An improper access control vulnerability in Odoo's auth_oauth module allows internal users to export OAuth tokens belonging to other users. This affects Odoo Community 15.0 and Odoo Enterprise 15.0 installations. Attackers could use stolen tokens to impersonate users and access external services.
💻 Affected Systems
- Odoo Community
- Odoo Enterprise
📦 What is this software?
Odoo by Odoo
Odoo by Odoo
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains access to all user OAuth tokens, enabling full impersonation across connected services, potential data exfiltration, and account takeover in external systems.
Likely Case
Internal user with malicious intent exports tokens of specific targets to gain unauthorized access to their external accounts and services.
If Mitigated
Limited impact with proper access controls and monitoring, though token exposure still represents a credential leak.
🎯 Exploit Status
Exploitation requires internal user credentials. The vulnerability is in the web interface functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Odoo 15.0 with security patch applied
Vendor Advisory: https://github.com/odoo/odoo/issues/193854
Restart Required: No
Instructions:
1. Update Odoo to the latest patched version of 15.0. 2. Apply the security patch from the Odoo repository. 3. Verify the auth_oauth module has proper access controls.
🔧 Temporary Workarounds
Disable OAuth token export functionality
allTemporarily remove or restrict the export feature for OAuth tokens in the auth_oauth module.
Modify Odoo module code to remove token export capability
Restrict internal user permissions
allReview and limit which internal users have access to user administration functions.
Review Odoo user groups and permissions
🧯 If You Can't Patch
- Implement strict access controls and monitor user activity for token export attempts
- Consider disabling OAuth authentication temporarily if feasible
🔍 How to Verify
Check if Vulnerable:
Check if running Odoo 15.0 with auth_oauth module enabled. Test if internal users can export other users' OAuth tokens.Check Version:
odoo --version or check Odoo web interface About pageVerify Fix Applied:
After patching, verify that internal users cannot export OAuth tokens belonging to other users.📡 Detection & Monitoring
Log Indicators:
- Unusual OAuth token export activities
- Multiple token access attempts from single user
Network Indicators:
- Unexpected OAuth token usage patterns to external services
SIEM Query:
Search for auth_oauth module export activities in Odoo access logs