CVE-2025-48878
📋 TL;DR
This vulnerability allows authenticated users with Service Desk Agent permissions in Combodo iTop to create ModuleInstallation objects without proper authorization. It affects iTop 3.x versions before 3.2.2, enabling privilege escalation through insecure direct object references.
💻 Affected Systems
- Combodo iTop
📦 What is this software?
Itop by Combodo
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could install malicious modules, potentially gaining administrative privileges, executing arbitrary code, or compromising the entire iTop instance.
Likely Case
Service desk agents could install unauthorized modules, modify system functionality, or gain elevated privileges beyond their intended role.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized module installations that can be detected and rolled back.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.2
Vendor Advisory: https://github.com/Combodo/iTop/security/advisories/GHSA-rj75-7cgw-4556
Restart Required: Yes
Instructions:
1. Backup your iTop instance and database. 2. Download iTop 3.2.2 or later from official sources. 3. Follow the iTop upgrade procedure for your deployment method. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Module Installation Permissions
allTemporarily remove module installation capabilities from Service Desk Agent profiles
Modify user profile permissions in iTop administration interface to remove 'Module Installation' rights
🧯 If You Can't Patch
- Implement strict access controls to limit which users can access module management interfaces
- Enable detailed logging for all module installation attempts and monitor for unauthorized activity
🔍 How to Verify
Check if Vulnerable:
Check iTop version in administration panel or via setup/install.php. Versions 3.0.0 through 3.2.1 are vulnerable.Check Version:
Check iTop version in web interface or examine config file for version information.Verify Fix Applied:
Confirm version is 3.2.2 or later and test that Service Desk Agent users cannot create ModuleInstallation objects.📡 Detection & Monitoring
Log Indicators:
- Unauthorized attempts to create ModuleInstallation objects
- Module installation events from non-admin users
Network Indicators:
- POST requests to module installation endpoints from unauthorized users
SIEM Query:
source="iTop" AND (event="module_install" OR event="ModuleInstallation") AND user_role!="Administrator"