Description
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ntop | ntopng | < 6.7.260717 | 6.7.260717 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | ntopng | No fix yet | — |
| Ubuntu 22.04 LTS | ntopng | No fix yet | — |
| Ubuntu 20.04 LTS | ntopng | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | ntopng | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ntopng | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ntopng | 5.2.1-7 | — |
References
- GitHub Security Advisory (GHSA-m22w-f647-vx88) vendor-advisory
- Patch Commit patch
- https://github.com/ntop/ntopng product
- https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/endpoints.lua technical-description
- https://github.com/ntop/ntopng/blob/f41cc1beff90e40e12bbc2cc135bdbf649ec559f/scripts/lua/rest/v2/delete/recipients.lua technical-description
- VulnCheck Advisory: ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers third-party-advisory