CVE-2025-24969 Overview
CVE-2025-24969 is an Insecure Direct Object Reference (IDOR) vulnerability in Combodo iTop, a web-based IT Service Management (ITSM) platform. Authenticated portal users can view any other contact's profile picture by manipulating the picture ID parameter in the URL. The flaw affects iTop versions prior to 3.2.1 and is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key]. Combodo addressed the issue in version 3.2.1.
Critical Impact
Any authenticated portal user can enumerate and retrieve profile pictures belonging to other contacts, leading to unauthorized disclosure of user imagery across the tenant.
Affected Products
- Combodo iTop versions prior to 3.2.1
- iTop Community, Professional, and Essential editions built on the affected core
- Portal user interface component of Combodo iTop
Discovery Timeline
- 2025-05-14 - CVE-2025-24969 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24969
Vulnerability Analysis
The vulnerability resides in the iTop portal component that serves contact profile pictures. The application accepts a picture identifier supplied in the URL and returns the corresponding image without validating whether the requesting user has permission to view that resource.
Because portal users are typically restricted to viewing their own contact record and a limited subset of related objects, this authorization gap allows lateral information disclosure across the entire contacts collection. An attacker with any valid portal account can iterate through sequential or predictable picture IDs to harvest images.
The issue is confined to picture retrieval and does not expose write operations, credentials, or ticket contents. However, exposed images can be used for social engineering, phishing pretext development, or organizational reconnaissance.
Root Cause
The root cause is missing object-level authorization on the picture retrieval endpoint. The portal controller resolves the requested picture ID directly against the database without confirming that the authenticated user is permitted to access the parent contact record. This pattern matches [CWE-639], where authorization decisions depend on a user-controlled key.
Attack Vector
Exploitation requires an authenticated portal session and network access to the iTop web interface. The attacker modifies the picture ID parameter in the URL used to render contact avatars and issues repeated requests, incrementing or fuzzing the identifier. Each successful response returns the image bytes for the referenced contact. No user interaction from the victim is required, and no elevated privileges are needed beyond a standard portal account.
See the GitHub Security Advisory GHSA-52p7-7f8f-j7pc for vendor-supplied technical context.
Detection Methods for CVE-2025-24969
Indicators of Compromise
- High-volume sequential requests to iTop portal picture endpoints from a single authenticated session
- Portal user accounts requesting picture IDs that do not correspond to contacts within their normal scope
- Anomalous GET request patterns with monotonically incrementing numeric ID parameters in URLs serving image content
Detection Strategies
- Enable web server access logging on the iTop front-end and retain full URL query strings for review
- Baseline normal portal user request rates and alert on outliers targeting contact or picture endpoints
- Correlate authenticated session IDs against the number of distinct picture IDs requested per hour
Monitoring Recommendations
- Forward iTop web server and application logs to a centralized logging or SIEM platform
- Build detection rules that flag single sessions requesting more than a threshold of unique picture IDs
- Review portal user role assignments to ensure no unexpected accounts hold portal access
How to Mitigate CVE-2025-24969
Immediate Actions Required
- Upgrade Combodo iTop to version 3.2.1 or later, which contains the vendor patch
- Audit portal user accounts and disable any that are unused or unowned
- Review recent web server logs for signs of picture ID enumeration prior to patching
Patch Information
Combodo released the fix in iTop version 3.2.1. Administrators should follow the standard iTop upgrade procedure, back up the database and configuration before applying the update, and verify the deployed version after installation. Refer to the GitHub Security Advisory GHSA-52p7-7f8f-j7pc for the official advisory.
Workarounds
- Restrict portal access to trusted networks using firewall or reverse proxy rules until the patch is applied
- Place a web application firewall (WAF) rule in front of iTop to rate-limit requests to picture endpoints
- Reduce the number of portal accounts and enforce strong authentication to limit the pool of potential abusers
# Verify installed iTop version after upgrade
grep -R "ITOP_VERSION" /path/to/itop/approot.inc.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
