Executive brief
A security vulnerability exists in ntopng, a network traffic monitoring tool, that allows attackers to perform unauthorized administrative actions. By tricking a logged-in administrator into clicking a malicious link or visiting a compromised website, an attacker can change passwords, add new administrative users, or modify system settings. This could lead to a complete takeover of the monitoring tool and unauthorized access to network traffic data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web interface of ntopng through version 2.4. The application fails to properly validate CSRF tokens in several administrative Lua scripts, including add_user.lua, change_user_prefs.lua, delete_user.lua, and password_reset.lua. An attacker can bypass existing protections by either omitting the CSRF token entirely or providing an arbitrary value. If an authenticated administrator visits a malicious site or clicks a crafted link, the attacker can execute high-privilege actions such as resetting the admin password or creating new administrator accounts. The issue was addressed in commits 1b2ceac and f91fbe3 by implementing proper token presence and validity checks.
Affected products
- ntop ntopng through 2.4
Timeline
- 2017-01-11: disclosed: Vendor notified
- 2017-01-14: advisory: NVD published date
- 2017-01-20: patched: Vendor fixed issue