Executive brief
ntopng is a web-based network traffic monitoring tool that tracks and analyzes network activity. A flaw in the threat intelligence blacklist configuration endpoint allows any authenticated user—not just administrators—to redirect downloads to attacker-controlled servers, disable security blocklists, or stop scheduled updates. This undermines the tool's ability to detect and block known threats.
Technical details
The POST /lua/rest/v2/edit/system/edit_blacklist.lua endpoint lacks an isAdministrator() check, allowing any authenticated user to call lists_utils.editList with arbitrary parameters (list_name, list_enabled, url, list_update). Changes persist via Redis and reload without lower-level authorization guards, enabling privilege escalation from user to threat-intelligence administrator. The fix adds authorization checks matching sibling endpoints.
Affected products
- ntop ntopng before 6.7.260717
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in version 6.7.260717