CVE-2017-5871

MEDIUMNuclei

Odoo <= 8.0-20160726 & 9.0 - Open Redirect

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-5871 has a selected CVSS score of 5.4 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHub1337rokudenashi/CVE-2017-5871Repository PoCby 1337rokudenashi1Scanner1 file

2.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that sends HTTP GET requests to Odoo endpoints with a redirect parameter and checks the Location header for a match, detecting the payload withheld open redirect vulnerability without exploiting it.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file containing a Nuclei template for payload withheld, an open redirect vulnerability in Odoo. The template defines HTTP requests and a regex matcher to detect the vulnerability. No executable code, obfuscation, or deceptive behavior is present. The file is a straightforward proof-of-concept detection template.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAML
Target softwareOdoo
Attack typesopen redirect
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that sends crafted requests and matches response headers to detect an open redirect vulnerability. It does not contain code to exploit the vulnerability (e.g., to steal credentials or perform phishing), only to identify its presence, which is characteristic of a scanner.

README.md:5-48

Requirements

  • Target must be running a vulnerable Odoo instance (<= 8.0-20160726 or 9.0) with the /web/session/logout or /web/dbredirect endpoints exposed.README.md:1README.md:38-40

Observed behavior

  • Sends HTTP GET requests to paths like /web/session/logout?redirect=payload withheld and /web/dbredirect?redirect=https%3a%2f%2foast.me%2f.README.md:36-40
  • Checks the response Location header using a regex to see if it redirects to a host containing 'oast.me'.README.md:43-47
  • Stops after the first matching request.README.md:42
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
Payload withheldThe file contains a YAML-based Nuclei template for detecting an open redirect vulnerability in Odoo.README.md:5-48
Url
Payload withheldThe template uses oast.me as a test redirect target, which is a common out-of-band testing service for vulnerability scanners.README.md:38-40
Review boundaries

What the analysis did not establish

  • Only the README.md file is provided; no other repository files (e.g., template YAML file) are included.
  • The analysis is based solely on the text content of the README; the actual Nuclei template file is not present in the evidence packet.
  • The artifact's behavior is inferred from the documented template; no execution or dynamic analysis was performed.
  • Only the README.md file was reviewed; no other files exist in the repository snapshot.
  • The digest line (line 48) is a hash and was not decoded or analyzed for hidden content, but its presence in a public template is typical for integrity verification.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryMEDIUMOdoo <= 8.0-20160726 & 9.0 - Open RedirectCVSS 5.4

An Open Redirect vulnerability in Odoo versions <= 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL.

Impact

Successful exploitation can redirect users to malicious sites, potentially leading to phishing attacks or information theft.

Remediation

Update Odoo to the latest patched version provided by the vendor.

WeaknessesCWE-601
Authors1337rokudenashi
Template tagscve2017cveodooredirectvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CPE: cpe:2.3:a:odoo:odoo:8.0:*:*:*:*:*:*:*
Shodan: title:"Odoo"
https://sysdream.com/cve-2017-5871-odoo-url-redirection-to/ https://nvd.nist.gov/vuln/detail/CVE-2017-5871

Source: ProjectDiscovery

References

3