CVE-2025-47286: Combodo iTop RCE Vulnerability

CVE-2025-47286 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used by organizations to manage IT infrastructure, incidents, and changes. CVE-2025-47286 affects iTop versions prior to 2.7.13 and 3.2.2. An authenticated administrator can execute arbitrary code on the underlying server by editing the iTop instance configuration. The vulnerability stems from improper neutralization of special elements in configuration parameters used to construct server-side commands [CWE-74]. Versions 2.7.13 and 3.2.2 escape and validate the configuration parameter before executing any derived command.

Critical Impact
Authenticated administrators can achieve arbitrary command execution on the iTop server, leading to full compromise of confidentiality, integrity, and availability of the host.

Affected Products

Combodo iTop versions prior to 2.7.13
Combodo iTop 3.x versions prior to 3.2.2
Self-hosted iTop deployments using vulnerable configuration handling

Discovery Timeline

2025-11-10 - CVE-2025-47286 published to the National Vulnerability Database
2025-11-21 - Last updated in NVD database

Technical Details for CVE-2025-47286

Vulnerability Analysis

The flaw exists in iTop's handling of administrator-supplied configuration values. iTop incorporates the configuration parameter into a command string that is subsequently executed on the server. Because the parameter is neither escaped nor validated, an administrator can inject shell metacharacters or command separators into the configuration. When iTop later builds and executes the command, the injected payload runs in the context of the web server process.

This class of issue is tracked as Improper Neutralization of Special Elements in Output Used by a Downstream Component [CWE-74]. The attack requires high privileges (administrator role) and no user interaction, but the network attack vector means the action can be carried out remotely through the iTop web interface.

Root Cause

The iTop configuration handler accepts string values from administrators and passes them into a command execution sink without sanitization. The fix in 2.7.13 and 3.2.2 escapes the configuration parameter and validates its content before the derived command is dispatched. Refer to the GitHub Security Advisory GHSA-4w93-rw6g-5m9c for vendor details.

Attack Vector

An attacker must first hold administrator credentials on the iTop instance. This can result from compromised admin accounts, insider threats, or chained authentication bypass issues. Once authenticated, the attacker modifies a configuration value that feeds into a server-side command. The injected commands then execute with the privileges of the iTop application user. The vulnerability mechanism is described in the vendor advisory; no verified public exploit code is currently available.

Detection Methods for CVE-2025-47286

Indicators of Compromise

Unexpected modifications to the iTop configuration file or configuration-edit audit entries by administrator accounts
Child processes spawned by the iTop PHP or web server process executing shell utilities such as sh, bash, cmd.exe, curl, or wget
Outbound network connections from the iTop host to unfamiliar destinations following configuration changes
New or modified files in iTop application directories that were not part of a planned deployment

Detection Strategies

Monitor the iTop audit log for administrator configuration edits and correlate them with process execution telemetry from the host
Alert on web server processes spawning interactive shells or scripting interpreters, which is atypical for iTop runtime behavior
Inspect configuration values for shell metacharacters such as ;, |, `, $(, and &&

Monitoring Recommendations

Forward iTop application logs, web server access logs, and host process telemetry to a centralized SIEM for correlation
Track administrator session activity, including IP address, time of day, and configuration changes performed
Establish a baseline of normal iTop child processes and alert on deviations

How to Mitigate CVE-2025-47286

Immediate Actions Required

Upgrade iTop to version 2.7.13 or 3.2.2 or later as published by Combodo
Audit existing administrator accounts and remove unused or excessive privileges
Review recent configuration changes for unexpected entries containing shell metacharacters
Rotate credentials for the iTop service account and any secrets stored in the configuration

Patch Information

Combodo released fixed versions 2.7.13 and 3.2.2, which escape and validate the configuration parameter before any derived command is executed. Patch details are documented in the Combodo iTop GitHub Security Advisory.

Workarounds

Restrict administrative access to iTop using network controls such as VPN or IP allowlisting until patching is complete
Enforce multi-factor authentication for all administrator accounts on the iTop portal
Limit the number of users assigned the administrator role and monitor their actions closely
Run the iTop application under a least-privileged service account to reduce the impact of command execution

bash

# Configuration example: restrict iTop admin interface access at the web server layer
# Example for Apache - allow only trusted management network
<Location "/itop/pages/preferences.php">
    Require ip 10.0.0.0/24
</Location>