Login Sign Up

CVE-2023-47489

7.8 HIGH

📋 TL;DR

This CVE describes a CSV injection vulnerability in Combodo iTop that allows a local attacker to execute arbitrary code via crafted scripts in CSV exports. The vulnerability affects iTop version 3.1.0-2-11973 and requires local access to the system. Attackers can exploit this to run malicious code on the server.

💻 Affected Systems

Products:
  • Combodo iTop
Versions: 3.1.0-2-11973
Operating Systems: All platforms running iTop
Default Config Vulnerable: ⚠️ Yes
Notes: Requires local access to the iTop interface; exploitation occurs through CSV export functionality.

📦 What is this software?

Itop by Combodo

View all CVEs affecting Itop →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise leading to data theft, lateral movement, and persistent backdoor installation.

🟠

Likely Case

Limited code execution within the iTop application context, potentially allowing data exfiltration or further privilege escalation.

🟢

If Mitigated

No impact if proper input validation and output encoding are implemented, or if the vulnerable components are disabled.

🌐 Internet-Facing: MEDIUM - While exploitation requires local access, internet-facing iTop instances could be targeted after initial access.
🏢 Internal Only: HIGH - Internal attackers or compromised accounts can exploit this to gain elevated privileges and move laterally.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access; multiple public references demonstrate the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Combodo security advisories for specific patched version

Vendor Advisory: https://www.combodo.com/security-advisories

Restart Required: Yes

Instructions:

1. Check current iTop version. 2. Apply the latest security patch from Combodo. 3. Restart the iTop service. 4. Verify the patch is applied.

🔧 Temporary Workarounds

Disable CSV Export

all

Temporarily disable the vulnerable CSV export functionality

Modify iTop configuration to remove CSV export options

Input Validation Enhancement

all

Implement strict input validation for CSV export parameters

Add input sanitization in export-v2.php and ajax.render.php

🧯 If You Can't Patch

  • Restrict access to iTop interface to trusted users only
  • Implement network segmentation to isolate iTop servers

🔍 How to Verify

Check if Vulnerable:

Check if running iTop version 3.1.0-2-11973 and test CSV export functionality with payloads

Check Version:

Check iTop configuration files or admin interface for version information

Verify Fix Applied:

Verify the patched version is installed and test CSV export with malicious payloads

📡 Detection & Monitoring

Log Indicators:

  • Unusual CSV export requests
  • Script-like content in export parameters
  • Multiple failed export attempts

Network Indicators:

  • Unexpected outbound connections from iTop server
  • CSV export requests with encoded payloads

SIEM Query:

source="iTop" AND (event="export" OR event="csv") AND (payload="=" OR payload="+" OR payload="-")

📊 Metadata

CVE ID: CVE-2023-47489
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: November 9, 2023
Last Updated: September 29, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON