CVE-2025-47286
📋 TL;DR
This vulnerability allows administrators in Combodo iTop to execute arbitrary code on the server by editing the instance configuration. It affects iTop versions before 2.7.13 and 3.2.2, requiring administrator privileges for exploitation.
💻 Affected Systems
- Combodo iTop
📦 What is this software?
Itop by Combodo
Itop by Combodo
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with complete administrative control, data exfiltration, and potential lateral movement to other systems.
Likely Case
Administrator account compromise leading to unauthorized code execution, configuration changes, and potential data manipulation.
If Mitigated
Limited impact due to proper access controls and monitoring, with only authorized administrators able to exploit.
🎯 Exploit Status
Exploitation requires administrator access to modify configuration parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.13 or 3.2.2
Vendor Advisory: https://github.com/Combodo/iTop/security/advisories/GHSA-4w93-rw6g-5m9c
Restart Required: Yes
Instructions:
1. Backup your iTop instance and database. 2. Download and install iTop version 2.7.13 (for 2.x branch) or 3.2.2 (for 3.x branch). 3. Follow the official upgrade procedure. 4. Restart the web server.
🔧 Temporary Workarounds
Restrict Administrator Access
allLimit the number of administrator accounts and implement strict access controls.
Configuration File Monitoring
linuxImplement file integrity monitoring on iTop configuration files.
# Example for Linux using auditd
sudo auditctl -w /var/www/html/iTop/conf/production/config-itop.php -p wa -k itop_config
🧯 If You Can't Patch
- Implement strict least-privilege access controls for administrator accounts
- Enable comprehensive logging and monitoring of configuration changes
🔍 How to Verify
Check if Vulnerable:
Check iTop version in the web interface or by examining the version file.Check Version:
Check the file 'version.php' in the iTop installation directory or view the version in the web interface footer.Verify Fix Applied:
Verify the installed version is 2.7.13 or higher for 2.x branch, or 3.2.2 or higher for 3.x branch.📡 Detection & Monitoring
Log Indicators:
- Unusual configuration file modifications
- Unexpected process execution from web server context
- Administrator account activity outside normal patterns
Network Indicators:
- Unusual outbound connections from the iTop server
- Unexpected command and control traffic
SIEM Query:
source="iTop_logs" AND (event="config_modified" OR event="admin_action")