CVE-2020-37078: i-doit CMDB Path Traversal Vulnerability

CVE-2020-37078 Overview

CVE-2020-37078 is an arbitrary file deletion vulnerability affecting i-doit Open Source CMDB version 1.14.1. The vulnerability exists in the import module and allows authenticated attackers to delete arbitrary files on the server's filesystem by manipulating the delete_import parameter. By sending a specially crafted POST request to the import module with a malicious filename, an attacker can remove critical system files, configuration files, or application data from the vulnerable server.

Critical Impact

Authenticated attackers can delete arbitrary files from the server filesystem, potentially causing denial of service, data loss, or facilitating further attacks by removing security controls.

Affected Products

• i-doit Open Source CMDB 1.14.1

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37078 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37078

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), which occurs when an application uses external input to construct a pathname that should be within a restricted directory, but the application does not properly neutralize special elements that could cause the pathname to resolve to a location outside of that directory.

In the case of i-doit Open Source CMDB 1.14.1, the import module fails to properly validate or sanitize the delete_import parameter before using it in file deletion operations. This allows authenticated users to specify arbitrary file paths, including those outside the intended import directory, enabling deletion of any file accessible to the web server process.

The network-based attack vector means exploitation can occur remotely once authentication is achieved. While authentication is required (reducing the likelihood of opportunistic attacks), any user with valid credentials to the CMDB system could potentially exploit this vulnerability. The impact is significant as it affects both integrity (arbitrary file modification/deletion) and availability (potential denial of service through deletion of critical files).

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the import module's file deletion functionality. The application fails to implement proper path canonicalization and validation checks on the delete_import parameter, allowing directory traversal sequences or absolute paths to reference files outside the intended scope. The lack of a whitelist-based approach or proper sandboxing of file operations enables attackers to manipulate the file path and target arbitrary filesystem locations.

Attack Vector

The attack is conducted over the network against the i-doit web application. An authenticated attacker crafts a malicious POST request to the import module endpoint, including a manipulated delete_import parameter. This parameter typically accepts filenames for legitimate import file cleanup operations, but due to the lack of validation, attackers can include path traversal sequences (such as ../) or absolute paths to target files outside the import directory.

The attacker could target critical configuration files like .htaccess, database configuration files, or even system files if the web server has sufficient permissions. This could lead to application misconfiguration, denial of service, or create conditions for further exploitation.

For technical details and proof-of-concept information, refer to the Exploit-DB #48427 entry and the VulnCheck Advisory for i-doit.

Detection Methods for CVE-2020-37078

Indicators of Compromise

• Unexpected POST requests to the i-doit import module containing path traversal sequences (../) in the delete_import parameter
• Web server access logs showing requests with unusually long or suspicious file paths in import-related endpoints
• Missing critical application or system files without explanation
• Application errors or service disruptions following suspicious import module activity

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns in POST parameters
• Monitor application and web server logs for anomalous requests to the import module, particularly those with suspicious delete_import values
• Deploy file integrity monitoring (FIM) on critical system and application files to detect unauthorized deletions
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing directory traversal sequences targeting i-doit endpoints

Monitoring Recommendations

• Enable detailed logging for the i-doit import module and review logs regularly for suspicious activity
• Set up alerts for file deletion events on the server, particularly in application directories and system paths
• Monitor for authentication attempts followed by immediate import module access patterns that may indicate exploitation attempts
• Implement real-time log analysis to correlate authentication events with subsequent file operations

How to Mitigate CVE-2020-37078

Immediate Actions Required

• Upgrade i-doit Open Source CMDB to a patched version that addresses this vulnerability
• Restrict access to the import module to only trusted administrative users
• Implement web application firewall rules to block path traversal attempts
• Review and limit file system permissions for the web server process to minimize the impact of potential exploitation
• Audit user accounts and remove unnecessary access privileges

Patch Information

Organizations using i-doit Open Source CMDB 1.14.1 should check the i-doit Official Website and SourceForge Project Page for updated versions that address this vulnerability. Apply the latest security patches as they become available.

Workarounds

• Disable or restrict access to the import module if it is not required for business operations
• Implement additional access controls at the web server level (e.g., IP-based restrictions) to limit who can access the import functionality
• Deploy a web application firewall configured to block requests containing path traversal sequences or suspicious file paths
• Run the web server process with minimal file system permissions to limit the scope of potential file deletions

# Example: Restrict import module access via Apache .htaccess
<Location "/i-doit/src/tools/php/import">
    Require ip 192.168.1.0/24
    Require valid-user
    # Additional authentication layer
</Location>