Is CVE-2017-5473 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5473 being exploited in the wild.

How severe is CVE-2017-5473?

High severity, with a CVSS score of 8.8, published 14 January 2017.

Is there a fix for CVE-2017-5473?

A patch was published on 2017-01-20: Vendor fixed issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5473 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-5473?

Check whether you run Ntopng. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5473: ntop ntopng CSRF in administrative web interface

CVE-2017-5473 · Severity: high · CVSS 8.8 · Published 2017-01-14

A security vulnerability exists in ntopng, a network traffic monitoring tool, that allows attackers to perform unauthorized administrative actions. By tricking a logged-in administrator into clicking a malicious link or visiting a compromised website, an attacker can change passwords, add new administrative users, or modify system settings. This could lead to a complete takeover of the monitoring tool and unauthorized access to network traffic data.

Technologies: Ntopng. Vendors: Ntop.

Quick answers

Is CVE-2017-5473 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5473 being exploited in the wild.
How severe is CVE-2017-5473?: High severity, with a CVSS score of 8.8, published 14 January 2017.
Which products and versions are affected?: ntop ntopng through 2.4.
Is there a fix for CVE-2017-5473?: A patch was published on 2017-01-20: Vendor fixed issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5473 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-5473?: Check whether you run Ntopng. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web interface of ntopng through version 2.4. The application fails to properly validate CSRF tokens in several administrative Lua scripts, including add_user.lua, change_user_prefs.lua, delete_user.lua, and password_reset.lua. An attacker can bypass existing protections by either omitting the CSRF token entirely or providing an arbitrary value. If an authenticated administrator visits a malicious site or clicks a crafted link, the attacker can execute high-privilege actions such as resetting the admin password or creating new administrator accounts. The issue was addressed in commits 1b2ceac and f91fbe3 by implementing proper token presence and validity checks.

Affected products

ntop ntopng through 2.4

Timeline

2017-01-11: disclosed: Vendor notified
2017-01-14: advisory: NVD published date
2017-01-20: patched: Vendor fixed issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.