CVE-2026-33240

Executive Summary

CVE-2026-33240 is a Reflected Cross-Site Scripting (XSS) vulnerability residing in the foreign key search criteria API of Combodo iTop, a web-based IT service management (ITSM) tool. All iTop deployments prior to version 3.2.3 are affected; the issue has been remediated in version 3.2.3. The vulnerability carries a critical CVSS score of 8.8 (High severity with High Confidentiality, Integrity, and Availability impact), and successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated user's browser session, potentially leading to session hijacking, privilege escalation, or lateral movement within the ITSM platform.

Technical Analysis

The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw classified under CWE-79. Per the NVD description, the affected component is the foreign key search criteria API. In web applications that expose search or lookup functionality, user-supplied input is frequently echoed back to the client without adequate validation or output encoding. In iTop's foreign key search functionality, the search criteria parameters are accepted from the client, processed server-side, and reflected in the HTTP response — apparently without sufficient sanitization or contextual output encoding.

The fundamental flaw is that an attacker can craft a malicious URL containing JavaScript payloads within the search criteria parameters. When a victim (an authenticated iTop user) clicks the crafted link, the server reflects the payload directly into the HTML response without neutralizing active script content. The victim's browser then parses the response and executes the injected script with the victim's session context and privileges.

The attack surface is the web interface of iTop, which is exposed to network access. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates:

• Attack Vector (AV): Network — exploitable remotely over the network.
• Attack Complexity (AC): Low — no special conditions are required to exploit the flaw.
• Privileges Required (PR): None — the attacker does not need an account; they only need to deliver a crafted URL to a legitimate user.
• User Interaction (UI): Required — the victim must click the malicious link.
• Scope (S): Unchanged — the impact is confined to the vulnerable component's security boundary.
• Confidentiality (C): High — the injected script can read sensitive data from the page, including session tokens and business data.
• Integrity (I): High — the script can modify page content, submit forms, and alter data on behalf of the victim.
• Availability (A): High — the script can disrupt the application's functionality.

The attack can be executed in a single round-trip: the malicious link contains the payload in a query parameter, the server reflects it, and the browser executes it. No pre-existing session or authentication is required on the attacker's part.

The NVD description does not provide the specific parameter names, endpoint paths, or code-level details for the affected API. Per accuracy requirements, this report does not fabricate those details. The vulnerability mechanism described above is consistent with the general class of reflected XSS in search/lookup response handlers.

Exploitation Scenarios

No public PoC or exploit code has been observed for CVE-2026-33240 as of this report. The attack chain described below is inferred from the vulnerability class (reflected XSS in a search criteria API) and standard web exploitation techniques.

Step 1 — Reconnaissance / Target Identification:
An attacker identifies exposed iTop instances via Shodan or other internet-wide scanning (e.g., searching for http.title:"iTop"). The attacker confirms the version is prior to 3.2.3 by inspecting version strings in page headers, login pages, or fingerprinting the application's JavaScript and CSS asset paths.

Step 2 — Triggering the Vulnerable Flaw:
The attacker crafts a URL pointing to the foreign key search functionality, embedding a JavaScript payload within the search criteria parameter. Because the parameter is reflected back to the browser unencoded, the payload is interpreted as active content by the browser rather than as inert text.

Step 3 — Payload / Execution Method:
The attacker delivers the crafted URL to a legitimate authenticated iTop user via phishing email, chat message, or by embedding it in a forum or support ticket. When the victim clicks the link, the browser sends the request to the iTop server. The server processes the search criteria and reflects the payload in the HTML response. The victim's browser executes the script in the context of the iTop domain, inheriting the victim's authentication cookies and session.

Example payloads at the class level include scripts that steal document.cookie, capture the DOM, or issue authenticated API requests to create new admin accounts, exfiltrate configuration data, or modify ticket/catalog records.

Step 4 — Post-Exploitation Impact:
The injected script operates with the victim's session privileges. If the victim is an administrator, the attacker gains full control of the iTop instance, including user management, workflow configuration, and access to all ITSM data stored in the application. If the victim is a standard user, the attacker can access and modify data within the victim's permissions, escalate privileges by creating new accounts (if permitted by the victim's role), or install persistent client-side implants (e.g., a keylogger injected into the page) for repeated compromise.

The CVSS subscores of High/High/High for C/I/A alignment with the full range of data theft, tampering, and service disruption that XSS can enable within an ITSM platform.

Impact Assessment

Business Impact: Combodo iTop is an IT service management platform that centralizes incident tickets, change requests, configuration items (CMDB), user directories, and service catalogs. A successful XSS exploitation compromises the integrity and confidentiality of these ITSM records. An attacker who compromises an administrative session can:

• Extract CMDB data, service contracts, and configuration secrets.
• Modify incident or change workflows, potentially causing service disruption.
• Create backdoor user accounts with elevated privileges.
• Use the compromised instance as a pivot point into internal network segments, as iTop instances often have integrations with directory services (LDAP/AD) and other operational tools.

Affected Systems: All Combodo iTop deployments running versions earlier than 3.2.3, including instances exposed to the internet or hosted on internal networks with user-accessible web interfaces.

Blast Radius: The CVSS score of 8.8 reflects the combination of network accessibility, low exploitation complexity, no prerequisite privileges, and high impact across all three security pillars. The requirement for user interaction (the victim clicking a link) is the sole mitigating factor.

Detection Guidance

The detection rules below target the exploitation of reflected XSS via search/lookup parameters. They focus on detecting suspicious query strings, script payloads in HTTP responses, and anomalous behavior consistent with XSS exploitation.

Sigma Rule

title: Detects Reflected XSS Attempts Against Combodo iTop Foreign Key Search API
id: 842f7c39-9d5e-4f7e-9c5b-3f0104a2b6e1
status: experimental
description: Detects HTTP requests to iTop foreign key search endpoints with script-like payloads in query parameters
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'alert('
      - 'fetch('
      - 'document.cookie'
      - '%3Cscript%3E'
      - '%3C/script%3E'
      - '%3Csvg'
      - '%3Cimg'
  condition: selection
falsepositives:
  - Legitimate security scanners (e.g., Nessus, Qualys) performing XSS probes
  - Users searching for literal strings containing these sequences
level: medium
tags:
  - attack.t1190
  - attack.t1059.007

YARA Rule

rule Detect_iTop_Reflected_XSS_Payloads {
    meta:
        author = "Valter Security Team"
        description = "Detects XSS payloads commonly used to exploit CVE-2026-33240 in Combodo iTop"
        date = "2026-01-15"
        cve = "CVE-2026-33240"
        severity = "high"
    strings:
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "XMLHttpRequest" ascii nocase
        $s7 = "fetch(" ascii nocase
        $s8 = "%3Cscript" ascii nocase
        $s9 = "search_criterion" ascii nocase
        $s10 = "foreign_key" ascii nocase
    condition:
        uint16(0) == 0x3f21 or uint16(0) == 0x3f26 // starts with "?" or "&"
        and 2 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8)
        and 1 of ($s9, $s10)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-33240 - Combodo iTop Reflected XSS Attempt in Foreign Key Search";
    flow:established,to_server;
    http.uri;
    content:"<script";
    nocase;
    http.uri;
    content:"onerror=";
    nocase;
    sid:90000110;
    rev:1;
    metadata:cve CVE-2026-33240, attack_target Web_Server, deployment Perimeter, tag XSS;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-33240;
    classtype:web-application-attack;
)

Elastic Detection

sequence by source.ip
  with maxspan=5s
  [ process where event.type == "start" and process.name == "nginx" or process.name == "apache2" ]
  [ network where event.type == "http" and http.request.body.content : "*<script*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%search%") OR like(uri_path, "%lookup%") OR like(uri_path, "%criteria%")
| search uri_query IN ("*<script*", "*%3Cscript*", "*javascript:*", "*onerror=*", "*onload=*", "*document.cookie*")
| stats count by src_ip, uri_path, uri_query, status
| sort - count

Wazuh OSSEC Rule

<group name="web-application-attack,xss,">
  <rule id="100112" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(php|aspx|do|action)</field>
    <regex>((%3C|<)(script|svg|img|iframe)|on(error|load)=|javascript:)</regex>
    <description>CVE-2026-33240 - Possible Reflected XSS payload in iTop foreign key search request</description>
    <group>web_application_attack,xss,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources). While the NVD description states the issue is fixed in version 3.2.3, no official patch notification, CVE-confirmed advisory page, or vendor release bulletin has been indexed by tracked patch sources. Administrators should validate the fix by upgrading and confirming the vendor's release notes.

Immediate Mitigations (1–2):

1. Upgrade to iTop 3.2.3 or later immediately. This is the only confirmed remediating action. Prior to upgrading, implement the network-level controls below if feasible.
2. Deploy a WAF rule to block requests to search/lookup endpoints containing script-like patterns (<script, javascript:, onerror=, %3Cscript). This provides a mitigation layer ahead of the application.
3. Restrict access to iTop web interfaces at the network perimeter. Only allow access from trusted IP ranges or via VPN. If remote access is required, enforce multi-factor authentication.
4. Educate authenticated users about phishing links and instruct them not to click untrusted URLs that reference internal iTop pages.

Patch/Upgrade Steps (2):

1. Backup the iTop database and application files.
2. Review the upgrade guide for the current iTop version to the 3.2.x branch.
3. Apply the upgrade to version 3.2.3 (or the latest available release of the ITIL core if newer).
4. After upgrading, verify the foreign key search functionality and confirm malicious payloads are no longer reflected in responses.
5. If the upgrade cannot be completed immediately, apply the vendor's security patch if released separately (none identified as of this writing).

Long-Term Hardening (3):

1. Implement a Content Security Policy (CSP) with script-src 'self' and object-src 'none' to limit the impact of any future XSS.
2. Enable HTTP security headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Referrer-Policy: strict-origin-when-cross-origin.
3. Establish a routine vulnerability scanning cadence for all web-facing applications, including iTop, and subscribe to Combodo's security advisory mailing list or RSS feed to receive patch notifications.
4. If feasible, move iTop behind a reverse proxy that performs request validation and response sanitization.

References

1. NVD Entry for CVE-2026-33240 — https://nvd.nist.gov/vuln/detail/CVE-2026-33240. National Vulnerability Database reference with the description, CVSS vector, and CWE classification.

2. Combodo iTop Official Site — https://www.combodo.com/itop. Vendor product page; version 3.2.3 release notes and upgrade documentation are expected to contain the patch details.

3. CWE-79: Improper Neutralization of Input During Web Page Generation — https://cwe.mitre.org/data/definitions/79.html. MITRE reference for the vulnerability class.

4. MITRE ATT&CK — T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/. Attack technique mapping applicable to this vulnerability's exploitation.

5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog. CVE-2026-33240 is NOT currently listed in the KEV catalog; no confirmed exploit-in-the-wild activity has been reported as of this writing.

Report generation date: 2026-01-15. Threat intelligence assessment based on NVD data, CVSS scoring, and CWE classification. No public exploit, proof-of-concept, or active campaign evidence is available as of the date of this report. Exploitation scenarios are inferred from the vulnerability class and standard XSS attack methodologies.