Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T16:17:24.503Z",
  "pubdate": "2026-09-21T16:17:24.503Z",
  "executiveSummary": "ntopng prior to version 6.7.260717 is susceptible to a critical OS command injection vulnerability via its vulnerability scanning REST endpoints.\nThe flaw stems from insufficient input validation and the absence of administrative authorization controls for specific scripts, allowing attackers to inject arbitrary shell commands.\nAn attacker can execute system commands with the privileges of the ntopng process user, potentially leading to full system compromise.\nExploitation can be achieved by authenticated non-admin users or, due to the vulnerability existing in GET-based endpoints with bypassable CSRF protections, by an unauthenticated attacker via a victim's browser.\nThe vulnerability allows for remote code execution (RCE) and represents a severe risk to confidentiality, integrity, and availability of the host infrastructure.",
  "technicalDetails": "The vulnerability originates in the Lua-based REST API endpoints: scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua. These endpoints are designed to accept user-provided input through the scan_ports parameter.\nThe primary root cause is the failure to enforce administrative authorization checks on these sensitive endpoints and the utilization of an insecure validation routine, validateSingleWord, which fails to neutralize shell metacharacters. Consequently, malicious payloads are passed directly to downstream logic.\nWithin the modules/vulnerability_scan/vs_utils.lua component, the unsanitized scan_ports parameter is concatenated into a string used to construct an nmap command. This string is subsequently executed by the system via ntop.execCmd or ntop.execCmdAsync, which utilize popen internally. By injecting shell metacharacters (e.g., semicolons, pipes, or backticks) into the scan_ports parameter, an attacker can escape the intended nmap command context and append arbitrary OS commands.\nThe attack flow for an authenticated user involves crafting a malicious HTTP GET request targeting the vulnerable endpoints, substituting the expected port configuration with a payload designed to execute system commands. Because the vulnerability exists within GET requests, and ntopng's CSRF protection mechanism is limited to POST request bodies, the application is also vulnerable to cross-site request forgery attacks. An attacker can entice an authenticated administrator to trigger the malicious request by hosting a specifically crafted link or page, thereby bypassing credential requirements entirely.\nSuccessful exploitation results in the execution of arbitrary commands with the user ID assigned to the ntopng service process. This facilitates post-exploitation activities including lateral movement, data exfiltration, or the installation of persistent backdoors on the underlying host operating system, provided that the nmap utility is available on the host environment."
}