full-disclosure - [FD] ntop-ng <= 2.0.151021

Open Source and information security mailing list archives

Message-ID: <28dd2b85a99e4b4d967e088211eb3244@seaexchmbx02.olympus.F5Net.com>
Date: Sat, 5 Dec 2015 00:11:22 +0000
From: Dolev Farhi <D.Farhi@...com>
To: "'fulldisclosure@...lists.org'" <fulldisclosure@...lists.org>
Subject: [FD] ntop-ng <= 2.0.151021 - Privilege Escalation

ntop-ng Privilege Escalation (CVE-2015-8368)

# Product Details:

ntop-ng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

# Vulnerability Details:

in the latest stable release of ntop-ng it is possible to escalate the privileges of a non-privileged user to the admin account by resetting the password, intercepting the request and replacing the HTTP parameters.

# Vulnerability technical information

1. Login with an unprivileged account

2. Change the account password and intercept the request, modify the username= and Cookie user= and change to the admin account

Example:

GET /lua/admin/password_reset.lua?csrf=XXXXXXXXXXXXXXXXXX&username=admin&old_password=12345&new_password=123456&confirm_new_password=123456 HTTP/1.1
Cookie: user=admin; session=XXXXXXXXXXXXXXXXXXXXXXXXX 3. Login with the admin account and the password you defined in step #2

# Solution
Upgrade to ntop-ng 2.2 stable

# Advisory timeline
26.11 - Notified ntop security
27.11 - Vulnerability acknowledged, maintainer confirms it also affects the dev branch
28.11 - CVE assigned (CVE-2015-8368)
01.12 - ntop-ng 2.2 released with the fix
04.12 - Full disclosure

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives