T09 · Insecure Skill Coding Practices
- Location
SKILL.md:16- Finding
Arbitrary Odoo Endpoint Override Can Disclose Authentication Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:16-17, 173, 193, 208
Vulnerability Type: Unvalidated user-controlled authentication endpoint
Risk Level: HighVulnerable Code
text 1. `temporary_url` — one-time URL for a specific operation 2. `user_url` — user-defined URL for the current sessionpython common = xmlrpc.client.ServerProxy(f"{resolved_url}/xmlrpc/2/common") version_info = common.version()python uid = common.authenticate(resolved_db, resolved_username, resolved_secret, {})python models = xmlrpc.client.ServerProxy(f"{resolved_url}/xmlrpc/2/object")Technical Analysis
The skill permits
temporary_urlanduser_urlto override the configured Odoo endpoint. It does not instruct the agent to validate the URL scheme, verify the destination against an allowlist, reject embedded credentials, or block loopback, link-local, and private-network destinations.After resolving the user-controlled URL, the documented authentication flow submits
resolved_db,resolved_username, andresolved_secretto its/xmlrpc/2/commonendpoint. Becauseresolved_secretis an Odoo password or API key, an attacker-controlled XML-RPC server can capture valid credentials. Allowing arbitrary destinations also creates a server-side request forgery primitive against services reachable from the agent environment.Attack Path
- An attacker or untrusted instruction asks the agent to use a supplied
temporary_urloruser_url. - The skill gives that value precedence over the trusted
ODOO_URL. - The agent creates an XML-RPC client for the supplied URL.
- The agent invokes
authenticateusing the resolved database name, username, and existing password or API key. - An attacker-controlled endpoint records those authentication values.
- The attacker uses the captured credentials against the legitimate Odoo instance, subject to the privileges of the compromised account.
For an SSRF variant, the attacker supp ...[truncated 765 chars]
- An attacker or untrusted instruction asks the agent to use a supplied
- Remediation
View remediation
Remediation Suggestions
- Restrict endpoint overrides to an explicit allowlist of trusted Odoo origins configured by an administrator.
- Require HTTPS for every non-development endpoint and reject plaintext HTTP.
- Parse and normalize URLs before use. Reject embedded credentials, fragments, unexpected ports, malformed hostnames, and non-HTTP schemes.
- Resolve hostnames and block loopback, link-local, multicast, reserved, and private-network addresses unless an administrator has explicitly approved them.
- Revalidate the destination after every redirect, or disable redirects entirely for XML-RPC authentication calls.
- Bind credentials to a specific trusted origin. Never reuse environment or session credentials automatically after changing the endpoint.
- Require the user to provide separately scoped credentials for a newly selected origin and clearly display the normalized destination before authentication.
- Require explicit confirmation before sending a secret to a temporary or newly configured endpoint.
- Apply connection and response-size limits to reduce SSRF and denial-of-service exposure.
- Clear temporary URLs and credentials immediately after the logical operation, including on authentication failure or exceptions.
- Use a least-privileged Odoo integration account and rotate any credential that may already have been sent to an untrusted endpoint.