CVE-2025-24785
📋 TL;DR
This vulnerability in iTop 3.2.0 allows attackers to send specially crafted URLs that trigger PHP errors, causing the dashboard to crash for subsequent users. It affects all iTop 3.2.0 installations with default configurations. The issue is a denial-of-service vulnerability that disrupts user access to the dashboard.
💻 Affected Systems
- iTop
📦 What is this software?
Itop by Combodo
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service affecting all dashboard users until manual intervention or server restart
Likely Case
Temporary dashboard unavailability for users who encounter the crashed page
If Mitigated
No impact if patched or proper input validation is implemented
🎯 Exploit Status
Exploitation requires sending crafted URLs but no authentication needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.1
Vendor Advisory: https://github.com/Combodo/iTop/security/advisories/GHSA-49rq-cgv9-7hv4
Restart Required: No
Instructions:
1. Backup your iTop installation and database. 2. Download iTop 3.2.1 from official sources. 3. Replace the existing installation with the patched version. 4. Verify the dashboard functionality.
🔧 Temporary Workarounds
Input validation at web server level
allImplement URL filtering or input validation at the web server or WAF level to block malicious dashboard URLs
🧯 If You Can't Patch
- Implement web application firewall rules to block suspicious dashboard URL patterns
- Monitor dashboard access logs for unusual URL patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check iTop version in the application interface or by examining the installation filesCheck Version:
Check the iTop web interface or examine the 'itop-version.php' file in the installation directoryVerify Fix Applied:
Verify version is 3.2.1 or higher and test dashboard functionality with various URL parameters📡 Detection & Monitoring
Log Indicators:
- PHP error logs showing dashboard-related exceptions
- Unusual URL patterns in access logs containing dashboard parameters
Network Indicators:
- HTTP requests with crafted dashboard URLs containing unusual layout_class parameters
SIEM Query:
source="iTop_logs" AND (dashboard AND error) OR (layout_class AND invalid)