CVE-2024-51995: Combodo iTop Auth Bypass Vulnerability

CVE-2024-51995 Overview

Combodo iTop is a web-based IT Service Management (ITSM) tool used by organizations to manage IT operations, incidents, and configuration items. CVE-2024-51995 is a broken access control vulnerability [CWE-284] in the ajax.render.php endpoint. An authenticated attacker can request any arbitrary route as long as a permitted operation is specified. The ajax.render.php page did not enforce the same access control pattern used by UI.php, allowing arbitrary route dispatching. Combodo addressed the flaw in iTop version 3.2.0 by aligning the access control model between both entry points.

Critical Impact

Authenticated attackers can dispatch arbitrary routes through ajax.render.php, exposing sensitive functionality and information beyond intended authorization boundaries.

Affected Products

• Combodo iTop versions prior to 3.2.0
• Combodo iTop Community Edition
• Combodo iTop Professional deployments using the vulnerable ajax.render.php endpoint

Discovery Timeline

• 2024-11-07 - CVE-2024-51995 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51995

Vulnerability Analysis

The vulnerability resides in the ajax.render.php endpoint of Combodo iTop. This endpoint dispatches requests to internal application routes based on user-supplied parameters. Unlike UI.php, which restricts the set of routes that can be dispatched, ajax.render.php accepts arbitrary route values when paired with any permitted operation.

An authenticated attacker can leverage this inconsistency to access application functionality that should be restricted. Successful exploitation results in high confidentiality impact and limited integrity impact, with scope change extending the reach of the attack beyond the vulnerable component.

The issue is categorized as Improper Access Control [CWE-284]. The attack requires low privileges and no user interaction, but the attack complexity is high due to preconditions on the operation parameter.

Root Cause

The root cause is inconsistent enforcement of access control patterns between two related entry points. UI.php implements a whitelist of dispatchable routes, while ajax.render.php omitted the same validation. This design gap allows the AJAX endpoint to serve as an unrestricted dispatcher for any internal route the operation parameter authorizes.

Attack Vector

Exploitation occurs over the network against an authenticated session. The attacker crafts an HTTP request to ajax.render.php specifying an arbitrary route parameter combined with an allowed operation value. The application then dispatches the requested route without validating whether the caller should reach that code path, bypassing the authorization boundary enforced elsewhere in the application.

See the GitHub Security Advisory GHSA-3mxr-8r3j-j2j9 for technical details of the affected code paths.

Detection Methods for CVE-2024-51995

Indicators of Compromise

• Requests to ajax.render.php containing unusual or unexpected route parameter values
• Authenticated user sessions accessing routes outside the scope of their assigned iTop profile
• Anomalous spikes in AJAX endpoint traffic from single user accounts
• Application logs showing operation dispatches inconsistent with the user's normal workflow

Detection Strategies

• Review iTop web server access logs for ajax.render.php requests with route parameters that do not match the expected UI-driven set
• Correlate authenticated user identity with dispatched route names to identify unauthorized access patterns
• Baseline normal operation and route parameter combinations, then alert on deviations

Monitoring Recommendations

• Enable verbose logging on the iTop application server to capture full query string data for ajax.render.php
• Forward web server and application logs to a centralized analytics platform for correlation across sessions
• Monitor for privilege escalation indicators such as configuration item modifications by users without administrative profiles

How to Mitigate CVE-2024-51995

Immediate Actions Required

• Upgrade all Combodo iTop instances to version 3.2.0 or later, which enforces access control on ajax.render.php consistent with UI.php
• Audit existing iTop user accounts and profiles to confirm least-privilege assignments
• Review recent access logs for ajax.render.php activity that predates the upgrade

Patch Information

Combodo released the fix in iTop version 3.2.0. The patch applies the same access control pattern used in UI.php to ajax.render.php, preventing arbitrary route dispatching. Details are published in the Combodo iTop Security Advisory GHSA-3mxr-8r3j-j2j9.

Workarounds

• No official workarounds exist for this vulnerability; upgrading to iTop 3.2.0 is the only supported remediation
• Restrict network access to the iTop application to trusted users and networks while planning the upgrade
• Apply web application firewall rules to block requests to ajax.render.php containing unexpected route parameter values as a temporary compensating control

# Example WAF rule concept to block unexpected route values on ajax.render.php
# (Adjust route allowlist to match your deployment)
SecRule REQUEST_URI "@endsWith /ajax.render.php" \
  "chain,phase:2,deny,status:403,id:1005199,msg:'iTop ajax.render.php route not allowed'"
  SecRule ARGS:route "!@rx ^(expected_route_1|expected_route_2)$"