CVE-2025-24021
📋 TL;DR
This vulnerability in iTop allows authenticated users with portal access to modify object fields they shouldn't have permission to change. It affects all iTop installations with portal access enabled. The issue is an authorization bypass that enables unauthorized data manipulation.
💻 Affected Systems
- iTop (IT Service Management tool)
📦 What is this software?
Itop by Combodo
Itop by Combodo
Itop by Combodo
⚠️ Risk & Real-World Impact
Worst Case
An attacker could modify critical configuration data, user permissions, or service management records, potentially disrupting IT operations or escalating privileges.
Likely Case
Users could modify fields they shouldn't have access to, leading to data integrity issues, unauthorized changes to tickets or configurations, or minor privilege escalation.
If Mitigated
With proper access controls and monitoring, impact would be limited to unauthorized field modifications that could be detected and rolled back.
🎯 Exploit Status
Exploitation requires authenticated portal access but appears straightforward based on the advisory description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.12, 3.1.3, or 3.2.1 depending on your version
Vendor Advisory: https://github.com/Combodo/iTop/security/advisories/GHSA-c8hm-h9gv-8jpj
Restart Required: Yes
Instructions:
1. Identify your iTop version. 2. Backup your installation and database. 3. Download the appropriate patched version (2.7.12, 3.1.3, or 3.2.1). 4. Follow iTop upgrade procedures for your version. 5. Restart web services.
🔧 Temporary Workarounds
Disable portal access
allTemporarily disable portal access to prevent exploitation while planning upgrade
# Modify iTop configuration to disable portal access
# Edit configuration file to restrict portal functionality
Restrict portal user permissions
allReview and reduce permissions for all portal users to minimum required
# Review user roles in iTop administration panel
# Modify portal user permissions to essential functions only
🧯 If You Can't Patch
- Implement strict monitoring of portal user activities and field modifications
- Apply network segmentation to isolate iTop instances and limit access to trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check iTop version in administration panel or via version.php file. If version is below 2.7.12, 3.1.3, or 3.2.1, you are vulnerable.Check Version:
Check iTop administration panel or examine the version.php file in the iTop installation directoryVerify Fix Applied:
After upgrade, verify version shows 2.7.12, 3.1.3, or 3.2.1. Test portal user permissions to ensure they cannot modify unauthorized fields.📡 Detection & Monitoring
Log Indicators:
- Unusual field modification events by portal users
- Multiple failed permission checks followed by successful modifications
- User activities outside normal permission boundaries
Network Indicators:
- Unusual patterns of portal API calls modifying object fields
- Increased traffic to field modification endpoints
SIEM Query:
source="iTop_logs" AND (event_type="field_modification" AND user_role="portal_user")