Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T20:16:34.453Z",
  "pubdate": "2026-08-21T20:16:34.453Z",
  "executiveSummary": "Combodo iTop prior to version 3.2.3 suffers from an access control vulnerability affecting uploaded sensitive files. This flaw allows unauthenticated threat actors to directly access sensitive files via intercepted or sniffed URLs without requiring any session validation or privilege verification. The root cause stems from missing authorization checks on uploaded resource endpoints. An unauthenticated attacker capable of sniffing network traffic or obtaining valid file URLs can bypass security mechanisms and retrieve confidential data stored within the application storage repository. The primary risk implication includes unauthorized exposure of sensitive IT service management data, potentially leading to further compromise of the underlying infrastructure. Exploitation requires no prior authentication or administrative privileges, relying solely on knowledge or interception of the target resource Uniform Resource Locator. Combodo has remediated this security issue in version 3.2.3 through the implementation of proper access control enforcement on file retrieval mechanisms.",
  "technicalDetails": "The vulnerability resides within the file handling and resource retrieval components of Combodo iTop prior to version 3.2.3. The root cause is the absence of robust authentication and authorization checks when processing HTTP requests for uploaded sensitive files. Specifically, the application fails to validate whether the requesting user session possesses the necessary permissions or authentication state required to access the requested resource identifier.\nNetwork exposure is inherent to the web-based architecture of Combodo iTop, where HTTP requests traverse standard network interfaces. Exploitation occurs when an unauthenticated attacker intercepts or sniffs the uniform resource locator pointing to a sensitive uploaded file. Because the application processes these direct requests without validating the caller's privilege level or session validity, the web server responds by serving the requested file directly to the client.\nThe attack flow proceeds as follows: First, an authorized or unauthorized transaction generates a resource URL pointing to an uploaded file within the iTop environment. Second, a malicious actor captures or sniffs this URL during transit or via information leakage vectors. Third, the attacker issues a direct HTTP GET request to the target URL without supplying any authentication credentials or session cookies. Fourth, the vulnerable server component processes the request, bypasses access control validations, and returns the sensitive file content in the HTTP response body.\nThe affected component handles file storage and retrieval functionality within the application ecosystem. Affected versions include all instances of Combodo iTop prior to version 3.2.3. The vulnerability requires zero authentication and zero privileges, meaning any unauthenticated network user capable of reaching the web application and acquiring the specific URL can successfully retrieve the data. Post-exploitation impact encompasses the unauthorized disclosure of sensitive organizational data, internal documentation, credentials, or system configurations contained within the accessed files, potentially facilitating lateral movement or advanced persistent threats against the enterprise environment."
}