A critical command injection vulnerability in ntopng allows attackers to gain remote code execution, posing a severe risk to the integrity and confidentiality of the host system.

The application fails to properly sanitize the scan_ports parameter in specific vulnerability-scan endpoints, allowing for OS command injection. Because these endpoints accept GET requests and lack sufficient CSRF protections, both authenticated users and unauthenticated attackers can trigger command execution as the ntopng process user.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the ntopng service. This level of access typically leads to a full system compromise, unauthorized data exfiltration, and the potential for lateral movement within the network. Given the CVSS score of 8.8, the impact on business operations and system security is considered high.

Immediate Action: Update ntopng to version 6.7.260717 or later immediately to incorporate the necessary input validation and security patches.

Proactive Monitoring: Review web access logs for suspicious GET requests targeting the scripts/lua/rest/v2/add/host/to_scan.lua or scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua endpoints containing shell metacharacters.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests that contain shell characters or unexpected parameters in the URI query string for the identified vulnerable endpoints.

Public Exploit Available: No

The risk posed by this vulnerability is substantial due to the potential for full system compromise via OS command injection. Organizations running versions of ntopng older than 6.7.260717 must prioritize the update to the latest version. Failure to patch may allow unauthorized actors to gain persistent control over the network monitoring host.