Vulnerability · Published Apr 5, 2022 · Assigned by GitHub_M

CVE-2022-24780Code Injection in Combodo iTop

High 8.8

In plain English

A high-severity code injection in iTop from Combodo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.7% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)5.7%top 7.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
Combodo	iTop	< 2.7.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 x_refsource_CONFIRM
https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 x_refsource_MISC
https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b x_refsource_MISC
https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 x_refsource_MISC
https://markus-krell.de/itop-template-injection-inside-customer-portal/ x_refsource_MISC
http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html x_refsource_MISC