CVE-2026-34949

Executive Summary

CVE-2026-34949 affects Combodo iTop, a web-based IT Service Management (ITSM) tool. Prior to version 3.2.3, an unauthenticated remote attacker can delete the .readonly file that is created during the setup process to prevent write operations on the instance. This flaw is rated 6.5 (Medium) under CVSS 3.1 with a network attack vector and no privileges or user interaction required, allowing an attacker to alter the availability and integrity posture of the system by enabling unauthorized write access. The vendor has fixed this issue in version 3.2.3, but no patch details, public PoC, or active exploitation evidence are yet available.

Technical Analysis

Combodo iTop uses a lock-file mechanism to enforce a read-only state on instances that have not completed the post-installation setup. This .readonly file is placed in the application's root directory during initial deployment. When present, the application routes users to a setup/maintenance view and denies all write operations. When the file is absent, the application assumes the instance is fully configured and permits normal read/write interactions.

The vulnerability class is CWE-306: Missing Authentication for Critical Function. The endpoint responsible for deleting the .readonly file is exposed without any authentication check. An unauthenticated attacker sending a properly crafted HTTP request (likely a DELETE or parameter-driven file-removal call) to the setup-dismissal function will trigger the removal of the lock file on the server's filesystem.

The attack surface is the publicly reachable iTop web interface. Because the endpoint does not require a session, token, or any credential, any network-reachable actor can invoke it. The underlying flaw is a missing authorization check on a state-changing file operation.

From a code-level perspective, the vulnerable routine likely performs a filesystem unlink operation on a hard-coded relative path (e.g., the application root or a configurable directory). The absence of an authentication gate, combined with no CSRF token or HTTP method restriction, makes the action trivially triggerable. The NVD description does not provide the specific URL path or function name; the technical detail is intentionally kept at the class level.

The CVSS vector reflects: Network attack surface (AV:N), Low attack complexity (AC:L), No privileges required (PR:N), No user interaction (UI:N), No scope change (S:U), No confidentiality impact (C:N), Low integrity impact (I:L) — because the attacker can force a state change that alters how the application behaves — and Low availability impact (A:L) — because the instance remains up but in an unintended operational mode.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker scans the internet for exposed iTop instances using Shodan-style queries (e.g., http.title:"iTop"). They fingerprint the version by inspecting the login page footer, REST API responses, or the /pages/UI.php content. Targets running versions below 3.2.3 are selected.

Step 2 — Triggering the Flaw: The attacker sends an unauthenticated HTTP request to the setup-dismissal endpoint that deletes the .readonly file. Since the endpoint lacks any authentication check (CWE-306), a single GET or POST request from the browser or a script suffices. No session cookie, API key, or CSRF token is validated.

Step 3 — Execution / Payload at Class Level: The request causes the server to execute an unlink() call on the .readonly file path. This is a server-side file deletion triggered purely by a missing authentication check on a state-changing function. The attacker does not need to upload or inject any payload; the request itself is the payload.

Step 4 — Post-Exploitation Impact: Once the .readonly file is deleted, the iTop instance transitions from read-only setup mode to full operational mode. This grants:

• Any unauthenticated user the ability to interact with the application's write functions, including creating, modifying, or deleting ITSM tickets, configuration records, and user data.
• A potential precondition for further attacks: if the instance contains vulnerable modules or has weak default credentials, the attacker can now leverage the write access to escalate privileges, inject malicious configuration, or exfiltrate sensitive operational data.

The impact is limited to integrity (low) and availability (low) because the attacker cannot directly read data or cause a full denial of service — but they can corrupt records and trigger unintended workflow changes.

Impact Assessment

Business Impact: iTop is used by IT teams for ticket management, change requests, incident tracking, and CMDB (Configuration Management Database) maintenance. An unauthenticated attacker deleting the .readonly file forces the instance into a fully writable state. This can lead to:

• Data Integrity Loss: Tickets, configuration items, and user accounts can be modified or deleted by unauthenticated actors.
• Operational Disruption: ITIL processes (incident, problem, change management) rely on accurate ticket states; corrupted records can misdirect incident response and change workflows.
• Reputational Damage: If the instance is externally exposed for customer self-service, visible data corruption may erode trust.
• Lateral Movement Precursor: Full write access can be chained with other vulnerabilities (e.g., stored XSS in ticket descriptions targeting administrators, or config manipulation enabling remote code execution).

Affected Systems: All Combodo iTop deployments running versions prior to 3.2.3 where the setup process has not been completed or where the .readonly lock is present. This includes cloud-hosted and on-premise instances exposed to the internet or to untrusted networks.

Blast Radius: The CVSS subscores confirm the limited direct impact: C:N/I:L/A:L. The confidentiality is untouched, meaning no direct data exfiltration. However, the integrity and availability impacts can cascade in complex ITSM environments where data consistency is critical. The actual blast radius expands when this flaw is combined with stored cross-site scripting or other post-authentication bugs, as the attacker can now inject malicious content into tickets viewed by administrators.

Detection Guidance

Sigma Rule

title: Combodo iTop Unauthenticated Readonly File Deletion
id: 6a3b1f9e-8c44-4a72-bc55-0e2d1f8a9c10
status: experimental
description: Detects HTTP requests targeting iTop setup-dismissal endpoints that remove the .readonly lock file without authentication
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      cs-method:
        - 'GET'
        - 'POST'
        - 'DELETE'
      cs-uri-query:
        - '*readonly*'
        - '*setup*dismiss*'
        - '*setup*complete*'
      sc-status: 200
    condition: selection
  level: high
  tags:
    - attack.t1190
    - cwe.306
    - cve.2026.34949

YARA Rule

rule Combodo_iTop_Readonly_Deletion_CVE_2026_34949
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects HTTP traffic patterns indicating an attempt to delete the .readonly file in Combodo iTop"
        cve = "CVE-2026-34949"
        date = "2026-08-19"
    strings:
        $s1 = ".readonly" ascii wide
        $s2 = "setup" ascii wide
        $s3 = "dismiss" ascii wide
        $s4 = "unlink" ascii wide
        $s5 = "DELETE" ascii wide
    condition:
        (uint16(0) == 0x4854 and ($s1 and ($s2 or $s3))) or
        ($s1 and $s4 and $s5)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-34949 Combodo iTop Unauthenticated .readonly File Deletion Attempt"; flow:to_server,established; content:".readonly"; http_uri; nocase; content:!"Cookie:"; http_header; http.method; content:"POST"; http.method; content:"GET"; http.method; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026081901; rev:1; reference:cve,2026-34949;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where event.type == "connection" and destination.port == 443]
  [http where http.request.method in ("GET", "POST", "DELETE") and
   http.request.uri like "*readonly*" and
   not http.request.uri like "*static*"]

Splunk SPL Query

index=web sourcetype=apache OR sourcetype=nginx
| where match(_raw, "\.readonly")
| stats count by src_ip, uri_path, http_method
| where http_method IN ("GET", "POST", "DELETE") AND match(uri_path, "(?i)setup|dismiss|readonly|complete")
| sort - count

Wazuh OSSEC Rule

<rule id="100349" level="12">
  <if_sid>31100</if_sid>
  <field name="url">\.readonly</field>
  <description>CVE-2026-34949: Combodo iTop unauthd .readonly deletion attempt</description>
  <group>web_application_attack,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source

1. Immediate Mitigations (before patching):

   • Restrict network access to iTop instances using firewalls or WAF rules that block external access to setup-related URIs (any path containing setup, install, or file-deletion parameters).
   • Place iTop behind a VPN or IP allowlist so that only trusted IT staff can reach the login page.
   • If possible, manually chmod the .readonly file to read-only (chmod 444) at the filesystem level, preventing the web server user from deleting it even if the vulnerable function is called.
   • Disable the setup module entirely if the instance is already configured, by removing or renaming the setup directory (verify this does not break the app).

2. Patch/Upgrade Steps:

   • Upgrade Combodo iTop to version 3.2.3 or later. The vendor has confirmed this release contains the fix.
   • After upgrading, verify the .readonly file is present and protected, then re-test by attempting to trigger the deletion from an unauthenticated session to confirm the fix.
   • Subscribe to Combodo's security advisory RSS feed or mailing list to stay informed of any errata.

3. Long-Term Hardening:

   • Enforce a change management policy for web application upgrades; never run unpatched versions in production.
   • Implement a WAF with virtual patching rules that block known vulnerable URI patterns until the patch is applied.
   • Conduct a quarterly review of internet-exposed assets using Shodan to identify and decommission unneeded iTop instances.
   • Require authentication for all setup-related functions — if the vendor does not provide that, isolate the application behind a reverse proxy that enforces mandatory mTLS.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-34949 — Official CVE record as provided.
2. Vendor Advisory: Combodo iTop release notes for version 3.2.3 (expected at https://www.combodo.com/itop — the vendor's official site). Direct advisory URL not yet indexed; monitor vendor page.
3. CWE-306 Reference: https://cwe.mitre.org/data/definitions/306.html — Missing Authentication for Critical Function.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application.
5. CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Not currently listed (status: NO). No evidence of active exploitation or threat actor campaigns at the time of this report.

Note: Insufficient technical detail is available regarding the exact vulnerable URI, function name, or request parameters; this report intentionally describes the attack at the vulnerability-class level to maintain accuracy.