Summary
ntopng's vulnerability-scan endpoints accept a scan_ports value that can contain shell metacharacters and later pass it into an operating-system command. When the scheduler runs the scan, this may allow command execution as the ntopng service account if nmap is installed; for the tcp_portscan and cve modules, a preliminary probe must also report the target as up.
ntopng's vulnerability-scan endpoints accept a scan_ports value that can contain shell metacharacters and later pass it into an operating-system command. When the scheduler runs the scan, this may allow command execution as the ntopng service account if nmap is installed; for the tcp_portscan and cve modules, a preliminary probe must also report the target as up.
Affected context
The issue affects ntopng's host-scan REST endpoints and the minute vulnerability-scan scheduler. The endpoints accept and persist scan_ports; the scheduler later incorporates that value into an nmap command executed through ntop.execCmd or ntop.execCmdAsync. The described behavior applies to versions before 6.7.260717. For the tcp_portscan and cve modules, the preliminary nmap -sn probe must report the target as up before the supplied ports are used.
The issue affects ntopng's host-scan REST endpoints and the minute vulnerability-scan scheduler. The endpoints accept and persist scan_ports; the scheduler later incorporates that value into an nmap command executed through ntop.execCmd or ntop.execCmdAsync. The described behavior applies to versions before 6.7.260717. For the tcp_portscan and cve modules, the preliminary nmap -sn probe must report the target as up before the supplied ports are used.
Exploit preconditions
- Attack surface: The host-scan REST endpoints and scheduled vulnerability scans.
- Required access: An authenticated session, including a non-administrator session; when login is disabled, the endpoints are exposed without authentication.
- Trigger point: The minute vulnerability-scan scheduler processes the persisted
scan_portsvalue. For tcp_portscan and cve modules, the preliminary probe must report the target as up. - Environment condition: nmap must be installed for the described command execution path.
- Why exploitation is possible: Input validation permits shell metacharacters, and the value is concatenated into a command that is executed through a process interface.
- Attack surface: The host-scan REST endpoints and scheduled vulnerability scans.
- Required access: An authenticated session, including a non-administrator session; when login is disabled, the endpoints are exposed without authentication.
- Trigger point: The minute vulnerability-scan scheduler processes the persisted
scan_portsvalue. For tcp_portscan and cve modules, the preliminary probe must report the target as up. - Environment condition: nmap must be installed for the described command execution path.
- Why exploitation is possible: Input validation permits shell metacharacters, and the value is concatenated into a command that is executed through a process interface.
Why this happens
The endpoints apply validateSingleWord to scan_ports, but that validation does not exclude shell metacharacters. The scheduler then concatenates the value into an nmap command and executes it through interfaces that use popen. Treating untrusted input as part of a shell command creates an OS command injection flaw, mapped primarily to CWE-78. The related CWE-77 and CWE-88 classifications describe broader command construction and argument injection concerns.
The endpoints apply validateSingleWord to scan_ports, but that validation does not exclude shell metacharacters. The scheduler then concatenates the value into an nmap command and executes it through interfaces that use popen. Treating untrusted input as part of a shell command creates an OS command injection flaw, mapped primarily to CWE-78. The related CWE-77 and CWE-88 classifications describe broader command construction and argument injection concerns.
Potential impact
- An attacker may execute operating-system commands as the ntopng service account.
- The ntopng process and its accessible data or resources could be compromised.
- Depending on the service account's permissions and deployment environment, an attacker could affect additional systems or services.
- An attacker may execute operating-system commands as the ntopng service account.
- The ntopng process and its accessible data or resources could be compromised.
- Depending on the service account's permissions and deployment environment, an attacker could affect additional systems or services.
General mitigation guidance
Defensive patterns focus on keeping untrusted values out of shell-interpreted command strings:
- Use process APIs that pass an executable and discrete arguments without invoking a shell.
- Validate ports against a strict, explicit numeric and range-based allowlist rather than relying on character-level checks.
- Keep scan configuration constrained to the values needed for the feature, and avoid persisting unchecked input for later execution.
- Apply authorization checks to scan-management operations and keep login protections enabled.
- Run the service with least privilege and limit its access to sensitive files, processes, and network resources.
Defensive patterns focus on keeping untrusted values out of shell-interpreted command strings:
- Use process APIs that pass an executable and discrete arguments without invoking a shell.
- Validate ports against a strict, explicit numeric and range-based allowlist rather than relying on character-level checks.
- Keep scan configuration constrained to the values needed for the feature, and avoid persisting unchecked input for later execution.
- Apply authorization checks to scan-management operations and keep login protections enabled.
- Run the service with least privilege and limit its access to sensitive files, processes, and network resources.
How teams detect issues like this
- Use static analysis to identify user-controlled values concatenated into commands or passed to shell-backed process APIs such as
popen. - Review validation applied to
scan_ports, including whether it enforces an explicit port allowlist rather than merely checking for a single word. - Inspect scheduled-task code paths to confirm that persisted request data is revalidated before use.
- Enforce code-review and CI policies that prohibit shell command construction from untrusted input and require authorization checks for sensitive REST endpoints.
- Monitor scan requests and service-account process activity for unexpected command execution patterns.
- Use static analysis to identify user-controlled values concatenated into commands or passed to shell-backed process APIs such as
popen. - Review validation applied to
scan_ports, including whether it enforces an explicit port allowlist rather than merely checking for a single word. - Inspect scheduled-task code paths to confirm that persisted request data is revalidated before use.
- Enforce code-review and CI policies that prohibit shell command construction from untrusted input and require authorization checks for sensitive REST endpoints.
- Monitor scan requests and service-account process activity for unexpected command execution patterns.
