CVE-2025-47932
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into Combodo iTop dashboards when rendered via AJAX calls. Users of iTop versions before 2.7.13 and 3.2.2 are affected, potentially enabling session hijacking, credential theft, or unauthorized actions.
💻 Affected Systems
- Combodo iTop
📦 What is this software?
Itop by Combodo
Itop by Combodo
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data exfiltration, or administrative compromise through persistent XSS payloads that execute whenever vulnerable dashboards load.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed in the context of authenticated users viewing malicious dashboards.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy headers blocking script execution.
🎯 Exploit Status
Exploitation requires ability to create or modify dashboards, typically requiring authenticated access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.13 or 3.2.2
Vendor Advisory: https://github.com/Combodo/iTop/security/advisories/GHSA-rmxq-fx69-7wg5
Restart Required: Yes
Instructions:
1. Backup your iTop installation and database. 2. Download patched version 2.7.13 or 3.2.2 from official sources. 3. Follow iTop upgrade documentation for your version. 4. Restart web server services.
🔧 Temporary Workarounds
Disable AJAX dashboard rendering
allModify configuration to prevent dashboard rendering via AJAX calls
Edit iTop configuration to disable AJAX dashboard features
Implement Content Security Policy
allAdd CSP headers to restrict script execution
Add 'Content-Security-Policy: script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict dashboard creation/modification permissions to trusted administrators only
- Implement web application firewall rules to detect and block XSS payloads in dashboard parameters
🔍 How to Verify
Check if Vulnerable:
Check iTop version in administration panel or via version.php fileCheck Version:
Check /env-production/itop/version.php or administration panelVerify Fix Applied:
Verify version is 2.7.13 or higher for 2.x branch, or 3.2.2 or higher for 3.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual dashboard modifications
- Suspicious AJAX requests to dashboard endpoints
- Script tags in dashboard parameter logs
Network Indicators:
- Malicious script payloads in HTTP requests to dashboard AJAX endpoints
SIEM Query:
source="iTop" AND (dashboard OR ajax) AND (script OR javascript OR eval)