Executive brief
ntopng is a network traffic monitoring application that administrators use to analyze and protect network activity. Prior to version 6.7.260717, unauthenticated attackers could execute arbitrary operating system commands on the server by exploiting unprotected vulnerability-scan endpoints. An attacker could trigger this remotely through a logged-in user's browser without needing ntopng credentials, potentially giving attackers full control of the monitoring infrastructure.
Technical details
The vulnerability exists in two REST endpoints (/add/host/to_scan.lua and /exec/host/schedule_vulnerability_scan.lua) that accept a scan_ports parameter without proper authorization checks or input validation. The parameter is passed through validateSingleWord, which fails to block shell metacharacters, and is then concatenated directly into an nmap command executed via ntop.execCmd/ntop.execCmdAsync. Since these endpoints accept GET requests, they bypass ntopng's CSRF protection which only validates POST bodies, allowing any authenticated user (or browser-hijacked session) to trigger code execution as the ntopng process account when nmap is installed.
Affected products
- ntop ntopng before 6.7.260717
Timeline
- 2026-09-21: disclosed