Description

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-21T22:16:37.143Z",
  "pubdate": "2026-08-21T22:16:37.143Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in Combodo iTop prior to version 3.2.3. This security flaw allows unauthenticated remote attackers to execute arbitrary PHP files located within the env-production directory on newly initialized iTop instances operating in a production environment. The vulnerability exposes the underlying web server to remote code execution risks, potentially leading to complete system compromise, unauthorized data access, and manipulation of IT service management infrastructure. The attack requires network access to the target iTop instance without requiring any prior authentication credentials or privileges. Remediation requires upgrading the affected software to version 3.2.3 or later where the issue has been officially addressed.",
  "technicalDetails": "The vulnerability resides in the authentication and request handling mechanisms of Combodo iTop prior to version 3.2.3, specifically affecting newly deployed instances configured in the production environment. The root cause stems from insufficient validation and enforcement of authentication checks when handling requests directed at specific resources. Consequently, unauthenticated remote attackers can leverage network exposure to bypass access controls designed to protect administrative and core application functionality. The exploitation method involves sending specially crafted HTTP requests that directly target arbitrary PHP files residing within the env-production directory. Because the application fails to verify the session state or authentication credentials of the requesting entity prior to execution, the web server processes and executes the targeted PHP payloads directly. The attack flow begins with the attacker probing the target iTop instance to confirm that it is a new installation running an affected version within the production environment. Upon confirmation, the attacker crafts a malicious request referencing an accessible PHP script within the env-production directory. Upon receipt, the vulnerable component processes the request without enforcing authentication checks, resulting in arbitrary code execution with the privileges of the web server process. Network exposure is external, allowing remote exploitation over standard HTTP or HTTPS protocols. Post-exploitation impact includes full system compromise, execution of arbitrary system commands, unauthorized access to sensitive IT service management databases, and potential lateral movement within the hosting network infrastructure. Affected versions comprise all Combodo iTop releases prior to 3.2.3."
}