Vulnerable Code

scripts/lua/modules/vulnerability_scan/vs_utils.lua, function exec_netscan(), line 2565.

function vs_utils.exec_netscan(host, cidr)
   local s = string.split(host, '%.')
   local net = s[1]..".."..s[2]..".."..s[3].."."
   local nmap = vs_utils.get_nmap_path()
   local command = nmap..' -sP -n ' .. net .. net_range
   out = ntop.execCmd(command)  -- popen("/bin/sh", "-c", command)
end

The host parameter is split on . and reassembled into an nmap command without shell metacharacter sanitization. At HEAD (commit 838ccd5, 2026-07-16), nmap_scan_host() and nmap_check_host() received partial input validation, but exec_netscan() remains vulnerable -- an incomplete fix bypass.

Note: the http_lint.lua global validation module blocks exploitation via the web API for most inputs, but exec_netscan() can also be reached from internal Lua callers.

Attack Path

1. Authenticated user triggers a network scan with host value 1$(id).2.3.0
2. exec_netscan() splits on .: s = {"1$(id)", "2", "3", "0"}
3. Command becomes: nmap -sP -n 1$(id).2.3.1-254
4. ntop.execCmd() passes this to /bin/sh -c, executing the injected id command
5. Same applies to backticks, pipe, semicolons embedded in any octet

Impact

An authenticated ntopng user can execute arbitrary OS commands on the server via crafted host parameters to the network scan function. While the web API has global validation that mitigates direct exploitation, the underlying function remains vulnerable and the fix applied to sibling functions was not applied to exec_netscan().