full-disclosure - [FD] ntop-ng < 3.4.180617 - Authentication bypass / session hijacking

Open Source and information security mailing list archives

Message-ID: <CAPiK3FtDZwimn4jysX+NVxzrUoDQM-GcdjkXQssh+w-nOb4ofA@mail.gmail.com>
Date: Mon, 2 Jul 2018 18:48:40 +0100
From: Ioannis Profetis <me@....re>
To: fulldisclosure@...lists.org
Subject: [FD] ntop-ng < 3.4.180617 - Authentication bypass / session
	hijacking

ntop-ng Authentication bypass (CVE-2018-12520)

# Product Details

ntopng is the next generation version of the original ntop, a network
traffic probe that shows the network usage, similar to what the popular top
Unix command does. ntopng is based on libpcap and it has been written in a
portable way in order to virtually run on every Unix platform, MacOSX and
on Windows as well.
# Vulnerability Details
An issue was discovered in ntopng 3.4.
The PRNG involved in the generation of session IDs is not seeded at program
startup.
This results in deterministic session IDs being allocated for active user
sessions. An attacker with foreknowledge of the operating system and
standard library in use by the host running the service and the username of
the user whose session they're targeting can abuse the deterministic random
number generation in order to hijack the user's session, thus escalating
their access.

# Exploit
A proof-of-concept for this vulnerability can be found at
https://gist.github.com/Psychotropos/3e8c047cada9b1fb716e6a014a428b7f. Note
that this script has been tested with Python 2.7, and requires the
'requests' module, which can be found in the Python Package Index.

# Mitigation
Upgrade to the latest stable version of ntop-ng 3.4.

# Attack Type
Remote, Unauthenticated, Escalation of Privileges, Information Disclosure

# Advisory Timeline
17/06/2018 - Reported issue to ntop-ng security team, received CVE
allocation (CVE-2018-12520), vendor acknowledged the issue and issued a
patch/updated their package repository with a patched version of the
software.
02/07/2018 - Full Disclosure

# References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12520
https://github.com/ntop/ntopng/commit/30610bda60cbfc058f90a1c0a17d0e8f4516221a

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives