ntop-ng - exploit.company

vendor:

ntop-ng

by:

Dolev Farhi

7,5

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: ntop-ng

Affected Version From: 2.0.151021

Affected Version To: 2.2

Patch Exists: YES

Related CWE: CVE-2015-8368

CPE: ntopng

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix, MacOSX, Windows

2015

ntop-ng <= 2.0.151021 - Privilege Escalation

In the latest stable release of ntop-ng it is possible to escalate the privileges of a non-privileged user to the admin account by resetting the password, intercepting the request and replacing the HTTP parameters. To exploit this vulnerability, a user must first login with an unprivileged account, then change the account password and intercept the request, modify the username= and Cookie user= and change to the admin account. Finally, the user can login with the admin account and the password they defined in the previous step.

Mitigation:

Upgrade to the latest version of ntop-ng (2.2) to fix this vulnerability.

Source

Exploit-DB raw data:

# Vulnerability title: ntop-ng <= 2.0.151021 - Privilege Escalation
# Author: Dolev Farhi
# Contact: dolev at flaresec.com
# Vulnerable version: 2.0.151021
# Fixed version: 2.2
# Link: ntop.org
# Date 27.11.2015
# CVE-2015-8368

# Product Details:
ntopng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

# Vulnerability Details:
in the latest stable release of ntop-ng it is possible to escalate the privileges of a non-privileged user to the admin account by resetting the password, intercepting the request and replacing the HTTP parameters.

# Vulnerability Proof of concept
1. Login with an unprivileged account
2. Change the account password and intercept the request, modify  the username= and Cookie user= and change to the admin account
Example:
GET /lua/admin/password_reset.lua?csrf=XXXXXXXXXXXXXXXXXX&username=admin&old_password=12345&new_password=123456&confirm_new_password=123456 HTTP/1.1
Cookie: user=admin; session=XXXXXXXXXXXXXXXXXXXXXXXXX
3. Login with the admin account and the password you defined in step #3.

Voila! you're an administrator.