Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T17:19:13.340Z",
  "pubdate": "2026-09-21T17:19:13.340Z",
  "executiveSummary": "ntopng versions prior to 6.7.260718 are susceptible to an improper authorization vulnerability within the system configuration backup modules. This flaw permits authenticated non-administrative users to bypass intended access control mechanisms to list and exfiltrate sensitive system backups.\nThe vulnerability resides in scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua. Because the exported backups contain sensitive Redis key data—specifically ntopng.user.* entries—successful exploitation results in the unauthorized disclosure of password hashes, API tokens, TOTP secrets, and WebAuthn credential data.\nThis compromise effectively allows a low-privileged attacker to escalate privileges or hijack administrative and user accounts. The risk is critical, as it bypasses authorization logic entirely for restricted system management operations. Exploitation requires authenticated access to the application, but no administrative privileges are necessary to perform the attack. Users are urged to upgrade to version 6.7.260718 to remediate this improper access control.",
  "technicalDetails": "The vulnerability is an Improper Access Control flaw within the ntopng REST API interface. The root cause is the absence of administrative role validation in the scripts responsible for configuration management, specifically within scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua. These scripts facilitate system-level operations that are intended to be restricted to administrative users but fail to verify the session's privilege level before execution.\nThe attack flow begins when an authenticated, non-administrative user submits a GET request to the vulnerable endpoints. The application processes these requests without performing an authorization check against the user's role. Upon executing the list_available_backups.lua script, the attacker gains a list of existing system backups. Subsequently, the attacker can invoke the download_backup.lua script to trigger the backup export process.\nThe technical impact is compounded by the design of the backup routine. The download path invokes the backup_config.export_backup function, which integrates the results of prefs_dump_utils.build_prefs_dump_table. This function explicitly includes the 'ntopng.user.*' Redis key space in the exported configuration data. Consequently, the downloaded backup file acts as a serialized representation of the application's sensitive user state.\nPost-exploitation, the attacker gains access to a comprehensive set of credentials and authentication secrets. This includes local user password hashes, which can be subject to offline cracking attempts, as well as API tokens that grant programmatic access to the ntopng instance. Furthermore, the inclusion of TOTP secrets and WebAuthn credential metadata provides the attacker with the necessary information to bypass multi-factor authentication (MFA) mechanisms or impersonate users, leading to full account takeover and administrative compromise of the ntopng service. Because the flaw exists in the application logic rather than the underlying web server or database architecture, it represents a complete failure of the internal authorization layer."
}