ntopng: Host Name Learned from Network Traffic Runs Script in the Console

Advisory ID: TP-2026-087
Product: ntopng (network traffic monitoring tool with a web console, C++ and Lua)
Vulnerability type: Stored cross-site scripting (CWE-79)
CVE: not requested
CVSS 3.1: 8.5 (High) · CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected versions: <= 6.7.0
Vendor advisory: GHSA-89wv-w893-9fvq
Status: no patch released, the vendor advisory names no fixed version
Reported: 4 July 2026

Summary

ntopng monitors network traffic and learns host names from mDNS, DHCP option 12, DNS PTR, NetBIOS and the server name in TLS connections. Those names reach the Hosts view of the web console, and they arrive there as live HTML. The check that accepts or rejects a name forbids only a small set of characters and lets angle brackets, quotes and slashes through. Anyone who announces such a name on the monitored network stores script that runs in the browser of every operator who opens the Hosts view. The attacker needs no account, only traffic that ntopng sees. This is a return of CVE-2014-5464, which fixed the same class twelve years ago in ntopng before 1.2.1.

Root cause

Host::isValidHostName blocks only colon, asterisk, space, at sign, comma and parentheses plus a leading underscore, and therefore permits <, >, ", ' and / (Host.cpp:1824), while setResolvedName checks nothing at all (:1853). The REST branch returns the stored name unmodified (lua/rest/v2/get/host/active_list.lua:172). The Vue frontend passes it on (page-hosts-list.vue:189) and writes it into the DOM with v-html (table.vue:118), where the browser parses it as HTML. The web console sends neither a Content-Security-Policy header nor an equivalent meta element, so nothing stands between source and sink. The input side has been patched field by field over the years, yet the name check itself still permits HTML metacharacters.

Proof of Concept

# The name must pass isValidHostName, which forbids spaces.
# So separate attributes with / and put values in quotes:
<img/src="x"onerror="xssok=document.domain">

# Announce that name on the monitored network (mDNS, DHCP option 12,
# NetBIOS, or through a PTR record that ntopng resolves).
# The operator opens the Hosts view -> the onerror handler fires.

The spelling <img/src=x/onerror=...> fails, because the unquoted value of src swallows the rest as a single attribute. The resolved name is truncated at roughly 62 characters, which is enough for exfiltration, for instance with a call to fetch written as a tagged template that needs no parentheses.

Impact

• Script execution in the web console's origin for every operator who opens the Hosts view, with no account on the attacker's side.
• Disclosure of the administrator password hash, since lua/rest/v2/get/ntopng/users.lua returns it in the victim's session.
• Takeover of the console, because the CSRF token sits in the DOM and the script can therefore create or modify user accounts.
• Persistence for as long as the host is held in memory, with the payload firing again on every visit to the view.

References

• Vendor advisory: GHSA-89wv-w893-9fvq
• Predecessor of the same class: CVE-2014-5464