{"action":"opened","issue":{"url":"https://api.github.com/repos/odoo/odoo/issues/13180","repository_url":"https://api.github.com/repos/odoo/odoo","labels_url":"https://api.github.com/repos/odoo/odoo/issues/13180/labels{/name}","comments_url":"https://api.github.com/repos/odoo/odoo/issues/13180/comments","events_url":"https://api.github.com/repos/odoo/odoo/issues/13180/events","html_url":"https://github.com/odoo/odoo/issues/13180","id":171618973,"number":13180,"title":"[SEC] 2016-07b-ogone-eval - Arbitrary code execution with Ogone transactions","user":{"login":"odony","id":2039870,"avatar_url":"https://avatars.githubusercontent.com/u/2039870?v=3","gravatar_id":"","url":"https://api.github.com/users/odony","html_url":"https://github.com/odony","followers_url":"https://api.github.com/users/odony/followers","following_url":"https://api.github.com/users/odony/following{/other_user}","gists_url":"https://api.github.com/users/odony/gists{/gist_id}","starred_url":"https://api.github.com/users/odony/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/odony/subscriptions","organizations_url":"https://api.github.com/users/odony/orgs","repos_url":"https://api.github.com/users/odony/repos","events_url":"https://api.github.com/users/odony/events{/privacy}","received_events_url":"https://api.github.com/users/odony/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-17T09:57:13Z","updated_at":"2016-08-17T09:57:13Z","closed_at":null,"body":"# Security Advisory (2016-07b-ogone-eval)\r\n\r\n### Arbitrary code execution with Ogone transactions\r\n\r\n**Affects**: Odoo 9.0 (Community and Enterprise Editions)\r\n**Component**: Ogone Payment module\r\n**Credits**: Ondřej Kuzník\r\n**OVE ID**: OVE-20160725-0004\r\n\r\n## I.   Background\r\n\r\nOdoo 9.0 integrates with different payment acquirers (such as Ingenico\r\nPayment Services, formerly Ogone), in order to process payments on\r\nthe e-commerce, or to subscribe to services via recurring invoices.\r\n\r\nIn order to properly process payment confirmations from external providers,\r\nOdoo executes some preconfigured business logic within a secure sandbox\r\nduring the finalization of each transaction.\r\n\r\n## II.  Problem Description\r\n\r\nThe business code (post-completion payload) executed during the\r\nfinalization of Ogone transactions can be altered by the \"Customer\" this\r\ntransaction applies to, before completing the transaction, IF this\r\nCustomer is also a user with \"Employee\" access.\r\n\r\n## III. Impact\r\n\r\nAttack Vector: Network exploitable\r\nAttack Complexity: Low\r\nAuthentication: \"Employee\" access required\r\nCVSS3: 7.3 ([AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C))\r\n\r\nBy creating real Ogone transactions (e.g. via a real eCommerce purchases),\r\nand by injection a malicious \"post-completion payload\" in the transactions\r\nbefore completing them, a malicious Employee could execute arbitrary\r\nbusiness logic with the credentials of the Administrator.\r\n\r\nThis could possibly compromise the security and integrity of the database,\r\nor allow the attacker to obtain elevated privileges.\r\n\r\nOdoo S.A. is not aware of any malicious use of this vulnerability.\r\n\r\n## IV.  Workaround\r\n\r\nNo workaround is available, but only databases using the \"payment_ogone\"\r\nmodule are vulnerable.\r\n\r\nOdoo Online servers have been patched as soon as the correction was\r\navailable.\r\n\r\n## V.   Solution\r\n\r\nApply the patches corresponding to your Odoo installation, or upgrade\r\nto the latest revision, either via GitHub or by downloading the\r\nlatest version from https://www.odoo.com/page/download\r\nor http://nightly.odoo.com\r\n\r\nTo apply the patch, change into the main directory of your Odoo\r\ninstallation (the one containing \"openerp\" and \"addons\" directories),\r\nthen execute the patch command, typically:\r\n\r\n       patch -p0 -f < /path/to/the_patch_file.patch\r\n       \r\nThis command assumes your installation layout corresponds to\r\nthe latest source code layout of the Odoo project on GitHub.\r\nIf your installation differs, please extract the various hunks\r\nfrom the patch files and apply them in the appropriate locations.\r\n\r\n## VI.  Correction details\r\n\r\nThe following list contains the revisions after which the vulnerability\r\nis corrected:\r\n\r\n- 9.0: rev. 0e104a1f216d86a7c9ae31911153c987299a919c\r\n- 9.0-ent (Enterprise): see 9.0.\r\n"}}
{"actor":{"display_login":"odony"}}