Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T20:16:34.157Z",
  "pubdate": "2026-08-21T20:16:34.157Z",
  "executiveSummary": "Combodo iTop prior to version 3.2.3 suffers from an insecure cryptographic mechanism protecting inline images that are accessible without authentication.\nThe vulnerability type involves weak pseudo-random number generation, leading to unauthorized access to sensitive image resources.\nThe impact includes the potential exposure of confidential visual data embedded within IT service management tickets or documentation.\nAffected systems are instances of Combodo iTop running versions prior to 3.2.3.\nThe risk implications involve information disclosure, as attackers can enumerate or predict access tokens to view restricted content without valid credentials.\nAttacker capabilities require the ability to send network requests to the target iTop instance to harvest or brute-force the generated secrets.\nExploitation requirements include interacting with publicly accessible endpoints protected only by the weak 24-bit pseudo-random secret.",
  "technicalDetails": "The root cause of the vulnerability lies in the implementation of a weak 24-bit pseudo-random secret utilized to secure inline images against unauthorized access.\nA 24-bit keyspace is cryptographically insufficient, providing only 16,777,216 possible combinations, which can be exhaustively brute-forced or analyzed rapidly using modern computational resources.\nThe vulnerable component handles the retrieval and authorization of inline images within Combodo iTop prior to version 3.2.3.\nNetwork exposure is present via web interfaces where unauthenticated endpoints serve inline images protected solely by this inadequate token scheme.\nAuthentication and privilege requirements are bypassed by design for these specific inline image endpoints, relying entirely on the secrecy of the weak token rather than session validation or access control lists.\nThe attack flow begins with an adversary identifying a targeted inline image URL containing the pseudo-random secret parameter.\nDue to the low entropy of the 24-bit secret, the attacker can systematically generate candidate keys or utilize precomputed collision spaces to identify valid token parameters.\nBy submitting requests with the guessed or derived 24-bit secret, the attacker successfully bypasses authorization checks and retrieves confidential inline images without authenticating to the Combodo iTop application.\nPost-exploitation impact is limited to unauthorized data viewing, specifically the exposure of sensitive operational data, internal infrastructure details, or user-submitted visuals contained within the harvested images."
}