Summary
ntopng allows authenticated non-administrator users to list and download system-configuration backups without an administrator authorization check. These backups may contain password hashes and, depending on configuration, API tokens, TOTP secrets, and WebAuthn credential data that could enable account compromise.
Affected context
The issue occurs in ntopng deployments where non-administrative authenticated users can access the system-configuration backup listing and download endpoints. It becomes risky when generated backups include user-related Redis data, such as local-user password hashes or authentication secrets, and access controls do not require administrator privileges.
Exploit preconditions
- Attack surface: Authenticated ntopng web API endpoints for backup listing and download
- Required access: A valid authenticated account without administrator privileges
- Trigger point: Requesting available system-configuration backups and downloading a selected backup
- Why exploitation is possible: The endpoints lack an administrator authorization check, and the backup generation path includes sensitive
ntopng.user.*data
Why this happens
The underlying bug combines missing authorization enforcement with excessive inclusion of sensitive data in exported configuration backups. The backup endpoints permit a lower-privileged authenticated user to reach functionality intended for administrators, while the export routine includes credential- related records. This maps primarily to CWE-200, Exposure of Sensitive Information, and also to CWE-862, Missing Authorization, because access control is not enforced at the required privilege boundary.
Potential impact
- A downloaded backup may disclose local-user password hashes
- Exposed hashes could enable offline password recovery or credential reuse
- API tokens may be disclosed when configured
- TOTP secrets or WebAuthn credential data could be exposed
- Attackers may compromise ntopng accounts or other systems using reused credentials
- Sensitive network-monitoring configuration and operational data may be revealed
General mitigation guidance
Mitigation generally focuses on enforcing least-privilege access and
minimizing sensitive data in exported artifacts.
Common defensive patterns include:
- Require explicit administrator authorization for backup listing and download operations
- Apply centralized authorization checks consistently across related API endpoints
- Exclude password hashes, API tokens, TOTP secrets, and WebAuthn data from routine backups
- Use purpose-built, encrypted secret storage rather than exporting authentication material with configuration
- Protect backup files with encryption, short retention periods, and restrictive filesystem and object-storage permissions
- Treat downloaded backups as sensitive credentials and rotate exposed secrets when disclosure is suspected
How teams detect issues like this
Organizations can detect similar weaknesses through:
- Static analysis and code review checks for endpoints that expose backup or export functionality without role checks
- Authorization tests covering authenticated users at every privilege level
- Data-classification scans that identify password hashes, tokens, and authentication secrets in generated archives
- API gateway or policy rules restricting backup operations to administrative roles
- Audit-log monitoring for backup listing and download activity by non-administrative accounts
- Automated security testing that compares endpoint behavior across user roles
