CVE-2024-52002: Combodo iTop CSRF Vulnerability

CVE-2024-52002 Overview

Combodo iTop is a web-based IT Service Management (ITSM) tool used by organizations to manage IT operations, incidents, and configurations. CVE-2024-52002 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting multiple URL endpoints in the application. An attacker who convinces an authenticated iTop user to visit a crafted page can trigger state-changing requests against the iTop instance without the user's consent. The vulnerability is tracked under [CWE-352] and impacts confidentiality, integrity, and availability of the affected instance. Combodo has addressed the issue in iTop version 3.2.0, and all users are advised to upgrade.

Critical Impact
Successful exploitation allows an attacker to perform unauthorized actions in iTop under the identity of a victim user, including changes that affect ITSM data integrity and service availability.

Affected Products

Combodo iTop versions prior to 3.2.0
Multiple URL endpoints within the iTop web application (see linked GHSA for full list)
Deployments exposing iTop to authenticated users over the network

Discovery Timeline

2024-11-08 - CVE-2024-52002 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52002

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) issue affecting several endpoints of the Combodo iTop web application. CSRF flaws allow an attacker to force an authenticated user's browser to submit requests the user did not intend. Because iTop endpoints perform sensitive operations under the user's authenticated session, an attacker can leverage these requests to modify configuration items, tickets, or user data. The attack requires user interaction, typically visiting a malicious page or clicking a crafted link, while an active iTop session exists. Exploitation is network-based and does not require prior privileges on the target application.

Root Cause

The affected endpoints did not enforce anti-CSRF protections such as synchronizer tokens or verification of the request origin. As a result, the server accepted state-changing HTTP requests without validating that the request originated from a legitimate iTop page. Combodo added CSRF protections to the impacted endpoints in the 3.2.0 release.

Attack Vector

An attacker crafts an HTML page or link containing hidden form submissions or scripted requests targeting vulnerable iTop endpoints. When an authenticated iTop user visits the page, their browser transmits the forged request along with valid session cookies. The iTop server processes the request as if it were authorized by the user. Refer to the Combodo iTop GitHub Security Advisory GHSA-xr4x-xq7v-7gqm for the full list of affected endpoints and technical specifics. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2024-52002

Indicators of Compromise

Unexpected state changes in iTop objects (tickets, configuration items, users) that do not correlate with legitimate user activity.
HTTP requests to sensitive iTop endpoints with Referer or Origin headers pointing to external, untrusted domains.
Audit log entries showing actions performed by users during time windows they were browsing unrelated sites.

Detection Strategies

Review iTop application logs for POST or state-changing requests lacking expected session context or with anomalous referrers.
Correlate web server access logs with iTop audit trails to identify requests initiated from external origins.
Deploy a Web Application Firewall (WAF) rule to flag requests missing anti-CSRF tokens on modified endpoints.

Monitoring Recommendations

Monitor for outbound browser navigation from users with active iTop sessions to unknown external domains.
Alert on bulk or repeated modifications to iTop objects performed within short time windows.
Track version banners of iTop deployments to confirm all instances run 3.2.0 or later.

How to Mitigate CVE-2024-52002

Immediate Actions Required

Upgrade all Combodo iTop instances to version 3.2.0 or later without delay.
Inventory internet-exposed iTop deployments and restrict access to trusted networks where feasible.
Instruct iTop users to log out of the application when not actively using it and to avoid browsing untrusted sites while authenticated.

Patch Information

Combodo released iTop 3.2.0 to address CVE-2024-52002 by adding CSRF protections to the affected endpoints. Full advisory details, including the complete list of vulnerable URLs, are available in the Combodo iTop GitHub Security Advisory GHSA-xr4x-xq7v-7gqm.

Workarounds

No official workarounds are provided by the vendor. Upgrading to 3.2.0 is the required remediation.
As a compensating control, restrict iTop network exposure via VPN or IP allowlisting to reduce attack surface until patching is complete.
Configure browsers and gateways to enforce strict SameSite cookie behavior where the application allows.

bash

# Example: verify installed iTop version after upgrade
grep -R "ITOP_VERSION" /var/www/html/itop/approot.inc.php

# Example: restrict iTop access at the reverse proxy (nginx)
# allow only trusted management network
location /itop/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://itop_backend;
}