Summary
A command injection vulnerability in ntopng's vulnerability-scan endpoints allows shell metacharacters in the scan_ports parameter to reach an nmap command without sufficient administrative authorization. An authenticated non-admin user, or a logged-in user whose browser is induced to issue a request, may cause operating-system commands to run under the ntopng process account when nmap is available.
Affected context
The issue occurs in ntopng deployments that expose the affected vulnerability-scan endpoints and permit non-admin users to reach them. The scan_ports value is insufficiently restricted before being incorporated into an nmap command, and the endpoints accept GET requests, creating an additional browser-based request-triggering concern where session and CSRF controls do not adequately cover the request format.
Exploit preconditions
- Attack surface: ntopng web vulnerability-scan endpoints
- Required access: An authenticated non-admin account, or a logged-in user's browser that can be induced to send a request
- Trigger point: Processing the scan_ports parameter during host vulnerability-scan scheduling or execution
- Runtime condition: The nmap utility must be available to the ntopng process
- Why exploitation is possible: Input containing shell metacharacters reaches command construction and execution without an effective administrator gate or safe argument-handling boundary
Why this happens
The vulnerability results from treating user-controlled scan configuration as shell command text. The application validates scan_ports only as a single word, but that validation does not establish that the value is safe for shell interpretation. The value is then concatenated into an nmap command and passed to command-execution paths, including asynchronous execution and popen. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because attacker-controlled data can alter the command interpreted by the operating system.
Potential impact
- Arbitrary operating-system commands may execute as the ntopng process account
- The ntopng host or container could be compromised
- Monitoring data, credentials, or configuration files could be exposed or altered
- The account's permissions could enable further lateral movement
- A compromised instance could be used to disrupt monitoring or launch attacks against connected systems
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing who can invoke vulnerability-scanning functionality.
Common defensive patterns include:
- Passing nmap arguments through an argument-vector API rather than constructing a shell command
- Applying strict allowlist validation for ports and other scan options
- Separating command arguments from executable selection and rejecting unexpected syntax
- Enforcing server-side authorization so scan operations are limited to appropriate administrative roles
- Applying CSRF protections consistently to every state-changing or command-triggering request method
- Running ntopng with the least privileges and limiting access to sensitive host resources
- Restricting availability and permissions of external scanning utilities where they are not required
How teams detect issues like this
Detection can combine source review, runtime monitoring, and authorization testing:
- Search for string concatenation or interpolation of request parameters into shell commands
- Flag uses of shell-based execution APIs such as popen and command wrappers that receive user-controlled data
- Review validators that check superficial character classes without enforcing a complete allowlist
- Test whether non-administrative roles can invoke scan or execution-related endpoints
- Inspect web logs for unusual scan_ports values, unexpected request methods, and repeated scan requests
- Monitor process execution from ntopng for anomalous child processes or commands
- Enforce static-analysis and secure-coding policies that require argument-vector execution for external tools
