CVE-2025-24785: Combodo iTop DOS Vulnerability

CVE-2025-24785 Overview

CVE-2025-24785 affects Combodo iTop, a web-based IT Service Management (ITSM) tool. In version 3.2.0, an attacker can send a crafted URL to the server that triggers a PHP error when saving a dashboard configuration. The next user who attempts to load the affected dashboard encounters a crashed start page. The vulnerability stems from insufficient validation of the layout_class parameter before persisting dashboard state. Version 3.2.1 resolves the issue by validating the layout_class value prior to save. The flaw is classified under [CWE-20] Improper Input Validation.

Critical Impact
Unauthenticated attackers can persistently break iTop dashboards, causing denial of service for subsequent users loading the affected start page.

Affected Products

Combodo iTop version 3.2.0
combodo:itop component (CPE: cpe:2.3:a:combodo:itop:*:*:*:*:*:*:*:*)
iTop deployments exposing dashboard save endpoints to untrusted users

Discovery Timeline

2025-05-14 - CVE-2025-24785 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24785

Vulnerability Analysis

The vulnerability resides in iTop's dashboard save workflow. When a user submits a request that includes a layout_class parameter, iTop 3.2.0 persists the value without verifying that it references a valid, existing layout class. On subsequent dashboard loads, iTop attempts to instantiate the referenced class. An invalid or malformed value triggers a fatal PHP error, causing the dashboard page to fail rendering.

The impact is persistent. Once a poisoned layout_class value is stored, every user that navigates to the affected dashboard receives the crashed page until an administrator restores a valid configuration. The attack requires network access and user interaction from the victim who loads the dashboard.

Root Cause

The root cause is missing input validation on the layout_class parameter before it is written to persistent storage. iTop 3.2.1 addresses this by verifying the layout_class against permitted values prior to saving. This aligns with [CWE-20], where trusted execution paths consume attacker-controlled input without sanitization.

Attack Vector

An attacker delivers a crafted URL targeting the dashboard save endpoint. The request stores an invalid layout_class value. When another user, typically an operator with dashboard access, loads the affected start page, iTop raises a fatal PHP error and fails to render the interface. The attack does not disclose data or modify integrity, but it disrupts availability of the dashboard component.

The vulnerability manifests during dashboard deserialization and rendering. No verified public proof-of-concept exploit is available. See the GitHub Security Advisory GHSA-49rq-cgv9-7hv4 for vendor details.

Detection Methods for CVE-2025-24785

Indicators of Compromise

PHP fatal error entries in iTop application logs referencing dashboard rendering or layout class instantiation
HTTP POST or GET requests to dashboard save endpoints containing unexpected or non-standard layout_class parameter values
User reports of blank or crashed iTop start pages following normal navigation

Detection Strategies

Inspect web server access logs for requests that modify dashboards and include unusual layout_class values inconsistent with the deployed iTop version's known layout classes
Correlate PHP error log entries with preceding dashboard save requests to identify the originating client IP and session
Monitor for repeated dashboard modification requests from unauthenticated or low-privilege sessions

Monitoring Recommendations

Enable verbose PHP error logging on iTop web servers and forward logs to a centralized log platform for alerting on fatal errors in dashboard code paths
Alert on HTTP 500 responses originating from iTop dashboard URLs to detect users encountering the crashed page
Track the running iTop version across all deployments and flag any host still on 3.2.0

How to Mitigate CVE-2025-24785

Immediate Actions Required

Upgrade Combodo iTop to version 3.2.1 or later, which validates the layout_class parameter before saving dashboard configuration
Restrict access to iTop dashboard modification endpoints to authenticated, trusted users where deployment permits
Audit stored dashboard configurations for invalid layout_class values and restore known-good state where necessary

Patch Information

Combodo released iTop 3.2.1 to remediate CVE-2025-24785. The fix enforces validation of the layout_class value prior to persisting dashboard changes. Refer to the Combodo iTop GitHub Security Advisory for release notes and download instructions.

Workarounds

Place iTop behind a web application firewall (WAF) and block requests to dashboard save endpoints that contain unexpected layout_class parameter values
Limit network exposure of iTop to internal or VPN-connected users until the upgrade to 3.2.1 is complete
Maintain backups of dashboard configuration data so administrators can quickly restore functional state after abuse attempts

bash

# Verify installed iTop version and plan upgrade to 3.2.1
grep -R "ITOP_VERSION" /var/www/itop/approot.inc.php
# Follow vendor upgrade procedure at:
# https://github.com/Combodo/iTop/security/advisories/GHSA-49rq-cgv9-7hv4