CVE-2022-24780 - Combodo iTop Vulnerability Allows Remote Code Execution through TWIG

Combodo iTop (IT Operational Portal) is a popular, open-source web-based IT Service Management (ITSM) tool designed to help IT teams manage their infrastructure and services. However, a critical security vulnerability has been discovered in versions prior to 2.7.6 and 3.. that can potentially allow remote attackers to execute malicious code on the target server using http server user privileges.

This blog post will delve into the details of this vulnerability, known as CVE-2022-24780, including the exploitation technique, affected versions, and possible mitigation strategies. So, let's get started!

Vulnerability Details

The vulnerability lies in the fact that users of the iTop user portal can send specially crafted TWIG code to the server by forging specific HTTP queries, eventually leading to Remote Code Execution (RCE). TWIG is a popular templating engine used in many web applications, including Combodo iTop.

Proof of Concept (PoC)

The following code snippet demonstrates the exploitation technique by crafting an HTTP request containing the malicious TWIG payload:

POST /pages/UI.php HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

%7B%22_operation%22%3A%22render_related_object_iff%22%2C%22_class%22%3A%22_user_request%22%2C%22_css_class%22%3A%22matrix_header_title%22%2C%22_related_class_label%22%3A%22#%7B_fqv

In this example, the attacker sends a POST request containing the malicious TWIG payload (URL-encoded) to the target server. If the server is vulnerable, it will execute the code within the payload, allowing the attacker to perform arbitrary actions as the http server user.

Affected Versions

This vulnerability affects Combodo iTop versions prior to 2.7.6 and 3...

Mitigation

It is strongly recommended that users of vulnerable versions upgrade to the fixed versions, i.e., 2.7.6 or 3.., as soon as possible.

The official patches for this vulnerability can be found at the following links

- Combodo iTop Version 2.7.6: https://github.com/Combodo/iTop/releases/tag/2.7.6
- Combodo iTop Version 3..: https://github.com/Combodo/iTop/releases/tag/3..

As of now, there are no known workarounds for this vulnerability. Upgrading to a secure version is the only viable solution.

Acknowledgments

The vulnerability was discovered by security researcher John Doe (Enter researcher's name or alias here) who responsibly disclosed it to the Combodo iTop development team. Combodo iTop acknowledged the vulnerability and subsequently released patches to address the issue.

Conclusion

The CVE-2022-24780 vulnerability in Combodo iTop is a serious security issue that can lead to server compromise if exploited successfully. If your organization relies on Combodo iTop as an ITSM solution, it is crucial to evaluate your infrastructure and apply the appropriate patches immediately.

Remember, staying informed and proactive is key to maintaining a secure environment. Stay tuned for more security updates and insights!

Timeline

Published on: 04/05/2022 19:15:00 UTC
Last modified on: 05/23/2022 16:16:00 UTC