Executive brief
ntopng is a web-based network traffic monitoring application. Prior to version 6.7.260718, any authenticated user—regardless of their admin status—could download and list full system configuration backups without authorization. These backups contain unsalted MD5 password hashes, API tokens, TOTP secrets, and WebAuthn credentials for all local user accounts, enabling attackers to crack admin passwords offline and gain full administrative control.
Technical details
Missing authorization checks in scripts/lua/rest/v2/get/system/configurations/download_backup.lua and list_available_backups.lua allow any authenticated user to enumerate and download backup files containing Redis keys ntopng.user.* and ntopng.prefs.*, including password hashes, API tokens, and TOTP secrets. Exploitation requires only valid login credentials and network access to the REST API endpoints. The backup content reaches backup_config.export_backup() which calls all_import_export:export() containing ntopng.user.* key patterns, exposing all local account credentials in a single downloadable JSON file.
Affected products
- ntop ntopng prior to 6.7.260718
Timeline
- 2026-09-21: disclosed