CVE-2017-5473: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2017-01-14T07:59Z
Repository: https://github.com/ntop/ntopng
Language: Lua
Files changed: scripts/lua/admin/add_user.lua, scripts/lua/admin/change_user_prefs.lua, scripts/lua/admin/delete_user.lua, scripts/lua/admin/password_reset.lua
Commit date: 2017-01-12 10:10:20 -0800
Commit message: Added fixes to avoid users to be manipulated with invalid CSRF token

Diff: diff --git a/scripts/lua/admin/add_user.lua b/scripts/lua/admin/add_user.lua
index 4ac99820..b742694f 100644
--- a/scripts/lua/admin/add_user.lua
+++ b/scripts/lua/admin/add_user.lua
@@ -6,10 +6,11 @@ dirs = ntop.getDirs()
 package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
 require "lua_utils"
 
 sendHTTPHeader('text/html; charset=iso-8859-1')
 
+if(_GET["csrf"] ~= nil) then
 if(haveAdminPrivileges()) then
    username = _GET["username"]
    full_name = _GET["full_name"]
    password = _GET["password"]
    confirm_password = _GET["confirm_password"]
@@ -31,5 +32,6 @@ if(haveAdminPrivileges()) then
       print ("{ \"result\" : 0, \"message\" : \"User added successfully\" }")
    else
       print ("{ \"result\" : -1, \"message\" : \"Error while adding new user\" }")
    end
 end
+end
\ No newline at end of file
diff --git a/scripts/lua/admin/change_user_prefs.lua b/scripts/lua/admin/change_user_prefs.lua
index f8fc5a77..f4a5832d 100644
--- a/scripts/lua/admin/change_user_prefs.lua
+++ b/scripts/lua/admin/change_user_prefs.lua
@@ -6,10 +6,11 @@ dirs = ntop.getDirs()
 package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
 require "lua_utils"
 
 sendHTTPHeader('application/json')
 
+if(_GET["csrf"] ~= nil) then
 username = _GET["username"]
 host_role = _GET["host_role"]
 networks = _GET["networks"]
 allowed_interface = _GET["allowed_interface"]
 
@@ -38,5 +39,6 @@ if(allowed_interface ~= nil) then
       return 
    end
 end
 
 print ("{ \"result\" : 0, \"message\" : \"Parameters Updated\" }")
+end
\ No newline at end of file
diff --git a/scripts/lua/admin/delete_user.lua b/scripts/lua/admin/delete_user.lua
index 5f74bf50..d80d04c3 100644
--- a/scripts/lua/admin/delete_user.lua
+++ b/scripts/lua/admin/delete_user.lua
@@ -6,10 +6,11 @@ dirs = ntop.getDirs()
 package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
 require "lua_utils"
 
 sendHTTPHeader('text/html; charset=iso-8859-1')
 
+if(_GET["csrf"] ~= nil) then
 if(haveAdminPrivileges()) then
    username = _GET["username"]
    
    if(username == nil) then
       print ("{ \"result\" : -1, \"message\" : \"Invalid parameters\" }")
@@ -20,5 +21,6 @@ if(haveAdminPrivileges()) then
       print ("{ \"result\" : 0, \"message\" : \"User deleted successfully\" }")
    else
       print ("{ \"result\" : -1, \"message\" : \"Error deleting user\" }")
    end
 end
+end
\ No newline at end of file
diff --git a/scripts/lua/admin/password_reset.lua b/scripts/lua/admin/password_reset.lua
index 1c8b7b84..3dbcf4ce 100644
--- a/scripts/lua/admin/password_reset.lua
+++ b/scripts/lua/admin/password_reset.lua
@@ -6,10 +6,11 @@ dirs = ntop.getDirs()
 package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
 require "lua_utils"
 
 sendHTTPHeader('text/html; charset=iso-8859-1')
 
+if(_GET["csrf"] ~= nil) then
 username = _GET["username"]
 old_password = _GET["old_password"]
 new_password = _GET["new_password"]
 confirm_new_password = _GET["confirm_new_password"]
 
@@ -34,5 +35,6 @@ end
 if(ntop.resetUserPassword(_SESSION["user"], username, old_password, new_password)) then
    print ("{ \"result\" : 0, \"message\" : \"Password changed successfully\" }")
 else
    print ("{ \"result\" : -1, \"message\" : \"Unable to set the new user password: perhaps the old password was invalid ?\" }")
 end
+end
\ No newline at end of file

Fixed code: if(_GET["csrf"] ~= nil) then
end
if(_GET["csrf"] ~= nil) then
end
if(_GET["csrf"] ~= nil) then
end
if(_GET["csrf"] ~= nil) then
end