ntop-ng < 3.4.180617 - Authentication bypass / session hijacking

[Ioannis Profetis <me () x86 re>]

ntop-ng Authentication bypass (CVE-2018-12520)

# Product Details

ntopng is the next generation version of the original ntop, a network
traffic probe that shows the network usage, similar to what the popular top
Unix command does. ntopng is based on libpcap and it has been written in a
portable way in order to virtually run on every Unix platform, MacOSX and
on Windows as well.
# Vulnerability Details
An issue was discovered in ntopng 3.4.
The PRNG involved in the generation of session IDs is not seeded at program
startup.
This results in deterministic session IDs being allocated for active user
sessions. An attacker with foreknowledge of the operating system and
standard library in use by the host running the service and the username of
the user whose session they're targeting can abuse the deterministic random
number generation in order to hijack the user's session, thus escalating
their access.

# Exploit
A proof-of-concept for this vulnerability can be found at
https://gist.github.com/Psychotropos/3e8c047cada9b1fb716e6a014a428b7f. Note
that this script has been tested with Python 2.7, and requires the
'requests' module, which can be found in the Python Package Index.

# Mitigation
Upgrade to the latest stable version of ntop-ng 3.4.

# Attack Type
Remote, Unauthenticated, Escalation of Privileges, Information Disclosure

# Advisory Timeline
17/06/2018 - Reported issue to ntop-ng security team, received CVE
allocation (CVE-2018-12520), vendor acknowledged the issue and issued a
patch/updated their package repository with a patched version of the
software.
02/07/2018 - Full Disclosure

# References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12520
https://github.com/ntop/ntopng/commit/30610bda60cbfc058f90a1c0a17d0e8f4516221a

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/