CVE-2024-31503

What it actually does

Incorrect access control permits an authenticated attacker to exfiltrate session cookies and CSRF tokens from other users through interaction with a malicious web page, enabling full account takeover.

Why it matters to the business

Successful exploitation can result in unauthorized access to sensitive ERP and CRM data, financial records, customer information, and internal workflows, potentially causing data breaches and operational disruption.

How an attack unfolds

An attacker crafts a malicious web page containing code designed to capture session cookies and CSRF tokens, then lures an authenticated Dolibarr user into visiting or interacting with it, after which the stolen credentials are used to hijack the victim's account.

How to fix it

Upgrade Dolibarr to the commit 45d56dffd284f80de1f14466051a2ee14bdd7132 or later; apply vendor patches promptly and enforce strict session management and content security policies as interim controls.

How to confirm the fix worked

Verify the running version is at or beyond commit 45d56dffd284f80de1f14466051a2ee14bdd7132; test by attempting to reproduce cookie exfiltration from a crafted page and confirm that session tokens are no longer leaked.

Typical attack path

1. Identify an authenticated Dolibarr user target
2. Craft a web page that triggers cookie and token exfiltration when visited
3. Deliver the crafted page via phishing or other social engineering
4. Capture the victim's session cookies and CSRF tokens upon interaction
5. Use the stolen credentials to authenticate as the victim and perform unauthorized actions

How to detect it

Examine web server and application logs for requests originating from unexpected external domains, unusual cookie transmission patterns, or repeated failed CSRF validations; monitor authentication logs for logins from new locations or devices shortly after suspected interactions.

What your security team should do

• Immediately upgrade all instances to the fixed commit 45d56dffd284f80de1f14466051a2ee14bdd7132
• Review and harden session handling and cookie security attributes
• Implement web application firewall rules to block known exfiltration patterns
• Conduct user awareness training on phishing and malicious page interactions