CVE-2020-36966: Dolibarr LDAP XSS Vulnerability

CVE-2020-36966 Overview

CVE-2020-36966 is a persistent cross-site scripting (XSS) vulnerability affecting Dolibarr 11.0.3, an open-source ERP and CRM platform. The vulnerability exists in the LDAP synchronization settings functionality, specifically within the /dolibarr/admin/ldap.php endpoint. Attackers with administrative access can inject malicious JavaScript code through multiple input parameters, including the host, slave, and port fields. When stored and subsequently rendered, these malicious scripts execute in the context of other users' browser sessions.

Critical Impact

Successful exploitation allows attackers to steal user cookie information, hijack administrative sessions, and potentially compromise the entire Dolibarr installation through persistent script injection in the LDAP configuration interface.

Affected Products

• Dolibarr 11.0.3
• Dolibarr versions prior to 11.0.3 (potentially affected)

Discovery Timeline

• 2026-01-30 - CVE CVE-2020-36966 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-36966

Vulnerability Analysis

This persistent cross-site scripting vulnerability (CWE-79) stems from insufficient input validation and output encoding in Dolibarr's LDAP administration interface. The application fails to properly sanitize user-supplied input before storing it in the database and subsequently fails to encode this data when rendering it in HTML contexts.

The vulnerable endpoint at /dolibarr/admin/ldap.php accepts configuration parameters for LDAP server connectivity. These parameters—specifically the host, slave, and port fields—are stored without adequate sanitization. When an administrator later views or modifies the LDAP settings, the stored malicious payload executes within their browser session.

The attack requires authenticated access to the administrative panel, typically limiting the initial attack surface. However, once injected, the malicious scripts persist and execute for any user who accesses the LDAP configuration page, making this a stored XSS vulnerability with potentially wider impact than reflected XSS variants.

Root Cause

The root cause of this vulnerability is improper neutralization of input during web page generation. The Dolibarr application does not implement adequate input validation when processing LDAP configuration parameters, nor does it perform proper output encoding when displaying these stored values in the administrative interface. This allows HTML and JavaScript content to be interpreted as executable code rather than rendered as harmless text.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker to access the Dolibarr administrative interface. The attacker navigates to the LDAP synchronization settings page and injects malicious JavaScript payloads into vulnerable form fields such as the LDAP host, slave server, or port parameters. These payloads are then stored in the application's database.

When any administrator subsequently views the LDAP configuration page, the browser renders the stored malicious content, executing the injected scripts. The attacker can craft payloads to exfiltrate session cookies, perform actions on behalf of the victim, or redirect users to malicious sites. The persistent nature of this XSS means the payload remains active until manually removed from the database.

For technical details and proof-of-concept information, refer to Exploit-DB #48504 and the VulnCheck Dolibarr Advisory.

Detection Methods for CVE-2020-36966

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in LDAP configuration fields in the Dolibarr database
• Unusual outbound network connections originating from administrator browsers when accessing LDAP settings
• Modified or suspicious entries in the host, slave, or port fields of LDAP configuration
• Browser console errors or unexpected script execution when loading /dolibarr/admin/ldap.php

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to /dolibarr/admin/ldap.php
• Enable Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Monitor application logs for suspicious input patterns containing <script>, javascript:, or event handlers like onerror
• Conduct periodic database audits of LDAP configuration tables for stored XSS payloads

Monitoring Recommendations

• Configure browser-based XSS auditors and report-only CSP policies to detect exploitation attempts
• Enable detailed access logging for administrative endpoints, particularly /admin/ldap.php
• Set up alerts for modifications to LDAP configuration settings outside of expected maintenance windows
• Monitor for cookie exfiltration attempts or unexpected cross-origin requests from the Dolibarr application

How to Mitigate CVE-2020-36966

Immediate Actions Required

• Upgrade Dolibarr to the latest stable version that includes patches for this vulnerability
• Review and sanitize existing LDAP configuration entries in the database for any injected scripts
• Restrict administrative access to trusted personnel only and enforce strong authentication
• Implement Content Security Policy headers to prevent inline script execution

Patch Information

Organizations should upgrade to a patched version of Dolibarr that addresses this XSS vulnerability. Check the Dolibarr Official Website for the latest security updates and release notes. Review the changelog to confirm the version includes fixes for CVE-2020-36966 before deployment.

Workarounds

• Implement a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads targeting LDAP configuration endpoints
• Add strict Content Security Policy headers to prevent execution of inline scripts: Content-Security-Policy: default-src 'self'; script-src 'self'
• Limit access to the LDAP administration page (/admin/ldap.php) to essential personnel using network-level access controls
• Manually sanitize any existing LDAP configuration data in the database by removing suspicious HTML or JavaScript content

# Example CSP header configuration for Apache
# Add to .htaccess or Apache configuration file
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'"