CVE-2021-32663
📋 TL;DR
CVE-2021-32663 is an authentication bypass vulnerability in iTop ITSM software that allows unauthenticated attackers to access the system setup interface. With specific parameters, this can lead to Server-Side Request Forgery (SSRF), enabling attackers to make requests to internal systems. All iTop users running affected versions are vulnerable.
💻 Affected Systems
- iTop (IT Service Management tool)
📦 What is this software?
Itop by Combodo
Itop by Combodo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use SSRF to access internal services, potentially leading to data exfiltration, internal network reconnaissance, or chaining with other vulnerabilities for further compromise.
Likely Case
Unauthenticated access to system setup could lead to configuration changes, while SSRF could allow limited internal network probing or interaction with internal APIs.
If Mitigated
With proper network segmentation and access controls, impact would be limited to the iTop server itself with minimal data exposure.
🎯 Exploit Status
The vulnerability is straightforward to exploit as it requires no authentication and specific parameters are documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.5 or 2.7.5 and later
Vendor Advisory: https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9
Restart Required: Yes
Instructions:
1. Backup your iTop installation and database. 2. Download the patched version (2.6.5+ or 2.7.5+). 3. Follow iTop upgrade documentation. 4. Restart web server services. 5. Verify the setup interface now requires authentication.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to iTop setup endpoints using web server configuration or firewall rules.
# Apache example: RewriteRule ^/setup.* - [F,L]
# Nginx example: location ~ ^/setup { deny all; }
Authentication Enforcement
allConfigure web server to require authentication for all /setup/* paths.
# Apache example: <Location /setup> AuthType Basic AuthName "Restricted" Require valid-user </Location>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate iTop from internal systems
- Deploy a WAF with rules to block unauthenticated access to /setup endpoints
🔍 How to Verify
Check if Vulnerable:
Attempt to access /setup/wizard.php without authentication. If accessible, system is vulnerable.Check Version:
Check iTop version in config file: grep 'ITOP_VERSION' /path/to/iTop/conf/production/config-itop.phpVerify Fix Applied:
Verify /setup/wizard.php now requires authentication and returns proper access denied for unauthenticated requests.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /setup/* endpoints
- HTTP 200 responses to setup pages without authentication logs
Network Indicators:
- Unusual outbound requests from iTop server to internal IPs following setup access
SIEM Query:
web_access_logs | where url contains "/setup" and user_agent not contains "authenticated" | count by src_ip🔗 References
- https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807
- https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec
- https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9
- https://github.com/Combodo/iTop/commit/43daa2ef088bf928a2386fa19324628c3f19b807
- https://github.com/Combodo/iTop/commit/6be9a87c150978752bc68baae1a5c4833ddadfec
- https://github.com/Combodo/iTop/security/advisories/GHSA-ghqc-r8f6-q9m9
