CVE-2025-49145: Combodo iTop Privilege Escalation Flaw

CVE-2025-49145 Overview

Combodo iTop is a web-based IT service management (ITSM) tool used to manage IT infrastructure, incidents, changes, and service catalogs. CVE-2025-49145 affects iTop versions prior to 2.7.13 and 3.2.2. The flaw allows a user with sufficient rights to create webhooks, typically an administrator, to drop the underlying database. The root cause is missing verification of the callback signature on webhook actions. Combodo addressed the issue in iTop 2.7.13 and 3.2.2 by enforcing callback signature verification. The weakness is classified as [CWE-863] Incorrect Authorization.

Critical Impact
An authenticated high-privilege user can trigger a webhook callback that drops the iTop database, resulting in complete loss of integrity and availability of ITSM data.

Affected Products

Combodo iTop versions prior to 2.7.13 (2.7.x branch)
Combodo iTop versions prior to 3.2.2 (3.x branch)
Deployments where administrators or webhook-capable roles are provisioned

Discovery Timeline

2025-11-10 - CVE-2025-49145 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49145

Vulnerability Analysis

iTop supports webhooks that invoke external HTTP callbacks in response to internal events. In vulnerable releases, the webhook subsystem does not verify the signature of callback requests. A user permitted to create or modify webhooks can define a callback that instructs the application to execute destructive database operations, including dropping the iTop database schema. The impact is loss of ITSM configuration items, tickets, change records, and audit history. Because the attacker must already hold webhook creation privileges, exploitation is gated by administrative access rather than being unauthenticated. Compromise of an administrator account, or misuse by an insider, is sufficient to trigger the flaw.

Root Cause

The root cause is missing callback signature validation in the webhook handler, an authorization defect tracked as [CWE-863]. Without verifying that a callback originates from a trusted source with an expected signature, iTop treats attacker-controlled payloads as legitimate directives. The fix in 2.7.13 and 3.2.2 introduces signature verification so that callbacks lacking a valid signature are rejected before their side effects execute.

Attack Vector

Exploitation requires network access to the iTop web interface and an authenticated session with rights to create webhooks. The attacker registers a malicious webhook or manipulates callback content, causing the server to process an unsigned callback that leads to a database drop. No user interaction beyond the attacker's own actions is required. See the GitHub Security Advisory GHSA-55q8-mfxr-pq4j for vendor details.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; refer to the vendor advisory for further technical context.

Detection Methods for CVE-2025-49145

Indicators of Compromise

Unexpected creation or modification of webhook definitions in the iTop administration console
Application or database logs showing DROP DATABASE, DROP SCHEMA, or bulk table removal events on the iTop backend
Sudden loss of iTop objects (tickets, CIs, users) and empty query results across modules
Outbound HTTP requests from the iTop server to unexpected callback URLs

Detection Strategies

Audit the iTop Webhook object class for entries added or edited by non-standard administrator accounts
Correlate MySQL or MariaDB general query and error logs with iTop web request logs to link destructive SQL to webhook execution
Monitor the iTop upgrade state and version banner to confirm that patched builds (2.7.13 or 3.2.2) are running
Baseline legitimate webhook callback destinations and alert on deviations

Monitoring Recommendations

Enable verbose iTop application logging for the webhook subsystem and forward logs to a centralized SIEM
Alert on administrative role assignments and privilege changes within iTop
Track database size and table counts to detect abrupt drops indicative of destructive operations

How to Mitigate CVE-2025-49145

Immediate Actions Required

Upgrade iTop to version 2.7.13 (2.7.x branch) or 3.2.2 (3.x branch) as released by Combodo
Review all existing webhook definitions and remove any that are unrecognized or unnecessary
Rotate credentials for iTop administrator accounts and enforce multi-factor authentication on the front-end SSO provider
Ensure current, tested database backups exist before applying updates

Patch Information

Combodo released fixed versions iTop 2.7.13 and 3.2.2, which enforce callback signature verification for webhook actions. The vendor advisory is published at GitHub Security Advisory GHSA-55q8-mfxr-pq4j. Apply the upgrade following Combodo's standard iTop upgrade procedure and verify the version string after deployment.

Workarounds

Restrict the webhook creation and modification permissions to a minimal set of trusted administrators until patching is complete
Place the iTop administration interface behind a VPN or IP allowlist to limit exposure
Disable the webhook feature in configurations where it is not required
Maintain offline database backups so that a destructive callback can be reversed via restore

bash

# Verify installed iTop version after upgrade
grep -R "ITOP_VERSION" /var/www/html/itop/approot.inc.php

# Example MySQL audit query to review recent destructive statements
SELECT event_time, user_host, argument
FROM mysql.general_log
WHERE argument LIKE 'DROP %'
ORDER BY event_time DESC;