Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html | Exploit Third Party Advisory VDB Entry |
https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 | Patch Third Party Advisory |
https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b | Patch Third Party Advisory |
https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 | Patch Third Party Advisory |
https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 | Third Party Advisory |
https://markus-krell.de/itop-template-injection-inside-customer-portal/ | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-04-05T18:30:18
Updated: 2022-05-23T15:06:07
Reserved: 2022-02-10T00:00:00
Link: CVE-2022-24780
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-04-05T19:15:08.100
Modified: 2022-10-07T03:33:58.320
Link: CVE-2022-24780
JSON object: View
Redhat Information
No data.
CWE