ntopng is vulnerable to OS command injection in its vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua prior to version 6.7.260717. The scan_ports parameter is accepted without administrator gate and passed through a validation function that permits shell metacharacters. This parameter is then concatenated into an nmap command executed via ntop.execCmd or ntop.execCmdAsync and popen, enabling command execution as the ntopng process user. The endpoints accept GET requests, and since CSRF validation applies only to POST bodies, an attacker can trigger the command injection through a logged-in user's browser without needing ntopng credentials. The vulnerability is addressed in version 6.7.260717.

An attacker with authenticated non-administrator access to ntopng can execute arbitrary operating system commands with the privileges of the ntopng process. This can lead to full compromise of the host running ntopng. The vulnerability can also be exploited via CSRF through a logged-in user's browser, increasing the attack surface. The CVSS score of 8.8 indicates high severity with impacts on confidentiality, integrity, and availability.

Upgrade ntopng to version 6.7.260717 or later, where this vulnerability is fixed. Until upgraded, restrict access to the vulnerable endpoints to trusted administrators only and consider disabling the vulnerability scan feature if feasible. Note that the vulnerability can be exploited via GET requests bypassing CSRF protections, so additional network-level controls may be necessary to mitigate risk.