CVE-2024-31503: Dolibarr ERP/CRM CSRF Vulnerability

CVE-2024-31503 Overview

CVE-2024-31503 is an incorrect access control vulnerability in Dolibarr ERP CRM versions 19.0.0 and earlier. The flaw allows authenticated attackers to steal session cookies and Cross-Site Request Forgery (CSRF) protection tokens from victim users. Exploitation requires user interaction with a crafted web page and results in account takeover. The vulnerability maps to [CWE-352] Cross-Site Request Forgery and [CWE-284] Improper Access Control.

Critical Impact
Successful exploitation enables attackers to hijack authenticated sessions and take over user accounts, including accounts with administrative privileges within the ERP and CRM platform.

Affected Products

Dolibarr ERP CRM 19.0.0
Dolibarr ERP CRM versions prior to 19.0.0
Deployments exposing the Dolibarr web interface to authenticated users

Discovery Timeline

2024-04-17 - CVE-2024-31503 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31503

Vulnerability Analysis

Dolibarr ERP CRM fails to enforce sufficient access controls around session and anti-CSRF token handling. An authenticated attacker can craft a malicious web page that, when visited by an authenticated Dolibarr user, extracts the victim's session cookies and CSRF protection tokens. Once obtained, the attacker replays these values to authenticate as the victim and perform arbitrary actions within the application.

The issue combines improper access control ([CWE-284]) with CSRF weaknesses ([CWE-352]). Because CSRF tokens are exposed rather than bound to a strict same-origin context, they provide no meaningful defense against a crafted request-forgery chain. The vulnerability scope changes because a compromised browser context leads to compromise of the Dolibarr application account.

Root Cause

The root cause is insufficient isolation between authenticated user context and cross-origin interactions. Session identifiers and CSRF tokens are accessible in ways that permit exfiltration through attacker-controlled pages. Proper protections such as SameSite=Strict cookies, origin validation, and per-request token binding are not enforced.

Attack Vector

An attacker with valid Dolibarr credentials lures a higher-privileged victim to open a crafted page. The page triggers requests or client-side logic that harvest the victim's session cookies and CSRF token. The attacker then reuses those artifacts to impersonate the victim and execute privileged operations. Refer to the GitHub CVE details for CVE-2024-31503 for public technical notes.

The vulnerability manifests in the session and CSRF token handling logic of the web application. No verified proof-of-concept code is available in the enriched data, so exploitation specifics are omitted here.

Detection Methods for CVE-2024-31503

Indicators of Compromise

Multiple concurrent sessions for the same Dolibarr user originating from different IP addresses or user agents.
Unexpected administrative actions performed by user accounts shortly after visiting external links.
HTTP referrer headers pointing to untrusted third-party domains preceding sensitive Dolibarr operations.
Reuse of identical DOLSESSID cookie values across geographically distinct source addresses.

Detection Strategies

Correlate Dolibarr web server access logs with authentication events to identify session reuse from anomalous origins.
Alert on high-privilege actions (user creation, permission changes, data exports) that follow cross-origin navigation.
Monitor for outbound requests from user browsers to unknown domains that immediately precede Dolibarr session activity.

Monitoring Recommendations

Enable verbose HTTP access logging on the Dolibarr web server and forward logs to a centralized analytics platform.
Track session cookie issuance and reuse patterns per user account.
Review audit trails within Dolibarr for administrative changes made by non-administrative endpoints.

How to Mitigate CVE-2024-31503

Immediate Actions Required

Upgrade Dolibarr ERP CRM to a version later than 19.0.0 that addresses the access control and CSRF weaknesses.
Force session invalidation for all active users after upgrading to remove any potentially hijacked sessions.
Restrict Dolibarr web interface access to trusted networks or VPN where feasible.
Review recent administrative actions and user account changes for evidence of unauthorized activity.

Patch Information

No vendor advisory URL is listed in the enriched data. Administrators should consult the Dolibarr project releases and upgrade to a fixed version beyond 19.0.0. Public technical notes are available in the GitHub CVE writeup for CVE-2024-31503.

Workarounds

Configure session cookies with HttpOnly, Secure, and SameSite=Strict attributes at the web server or reverse proxy level.
Enforce strict Content-Security-Policy and Referrer-Policy headers to limit exposure of tokens to third-party contexts.
Require re-authentication for sensitive administrative actions within Dolibarr.
Educate users to avoid opening untrusted links while authenticated to the ERP platform.

bash

# Example Nginx hardening for Dolibarr session cookies and headers
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Frame-Options "DENY" always;

proxy_cookie_path / "/; HttpOnly; Secure; SameSite=Strict";