Glances - CraftedSignal Threat Feed

Glances Cross-Origin Information Disclosure via Unauthenticated REST API

hello@craftedsignal.io — Fri, 26 Jan 2024 12:00:00 +0000

Glances, a system monitoring tool, exposes a REST API (/api/4/*) that is accessible without authentication. Prior to version 4.5.4, a permissive Cross-Origin Resource Sharing (CORS) policy (Access-Control-Allow-Origin: *) allows cross-origin requests from any website. An attacker can exploit this vulnerability by hosting a malicious website that, when visited by a user running Glances in web mode (e.g., glances -w -B 0.0.0.0), can retrieve sensitive system information via the user's browser. This information includes process lists, system details (hostname, OS, CPU info), memory and disk usage, network interfaces and IP addresses, and running services and metrics. The vulnerability, identified as CVE-2026-34839, allows for unauthenticated remote information disclosure.

Attack Chain

A victim starts Glances in web mode using the command glances -w -B 0.0.0.0, exposing the REST API on port 61208.
The victim visits a malicious website controlled by the attacker.
The malicious website contains JavaScript code that sends an HTTP GET request to the Glances API endpoint http://:61208/api/4/all.
Due to the permissive CORS policy (Access-Control-Allow-Origin: *), the Glances server allows the cross-origin request.
The Glances server responds with a JSON payload containing sensitive system information, including process lists, system details, network configuration, and resource usage.
The malicious JavaScript code parses the JSON response and extracts the sensitive information.
The extracted information is logged to the attacker's console or sent to an attacker-controlled server for analysis and further exploitation.
The attacker uses the disclosed information for reconnaissance, identifying potential targets for further attacks.

Impact

Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to gather sensitive information about the victim's system. This can lead to a comprehensive system fingerprint, including running processes, network configuration, and internal IP addresses. While the exact number of victims is unknown, any Glances instance running in web mode with a vulnerable version (prior to 4.5.4) is susceptible. This information disclosure can be used for targeted attacks, such as exploiting other vulnerabilities based on the identified software and configurations or performing social engineering attacks based on the disclosed system information.

Recommendation

Upgrade Glances to version 4.5.4 or later to patch CVE-2026-34839.
Implement network monitoring rules to detect unusual outbound connections from browsers to port 61208, indicating potential exploitation attempts. See the "Detect Glances API Access from Browser Process" Sigma rule below.
Deploy the Sigma rule "Detect Glances Web Mode Startup" to identify instances of Glances being run in web mode.
Review and restrict network exposure of Glances web interface by modifying the -B parameter, avoiding 0.0.0.0, to limit the scope of the exposed API.

Glances IP Plugin SSRF Vulnerability Leading to Credential Leakage

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A server-side request forgery (SSRF) vulnerability has been identified in the Glances IP plugin, affecting versions prior to 4.5.4. The vulnerability stems from insufficient validation of the public_api configuration parameter. An attacker with the ability to modify the Glances configuration file can exploit this flaw to force the application to make HTTP requests to arbitrary internal or external endpoints. Furthermore, if public_username and public_password are configured, Glances automatically includes these credentials within the Authorization: Basic header of the outbound requests, leading to potential credential leakage to attacker-controlled servers. This issue allows attackers to probe internal network services, retrieve sensitive data from cloud metadata endpoints (e.g., AWS, Azure, GCP), and exfiltrate credentials. The root cause is the direct usage of the public_api value within the urlopen_auth function without proper validation.

Attack Chain

Attacker gains access to the Glances configuration file (e.g., through compromised credentials or exposed configuration management).
Attacker modifies the glances.conf file, setting public_api to a malicious URL, such as http://127.0.0.1:9999/ssrf-poc or a cloud metadata endpoint (http://169.254.169.254/).
Attacker sets public_username and public_password in the glances.conf file to capture the Basic Authentication header.
The Glances application, particularly the IP plugin, reads the modified configuration file during startup or refresh.
The ThreadPublicIpAddress class initiates an HTTP request to the attacker-controlled URL using the urlopen_auth function in glances/globals.py.
The urlopen_auth function sends the request with the Authorization: Basic header containing the configured username and password, to the attacker controlled endpoint.
The attacker's server receives the request, captures the leaked credentials from the Authorization header, and potentially uses them for further exploitation.
The Glances API endpoint /api/4/ip reflects the attacker-controlled data, potentially injecting arbitrary information into the application.

Impact

Successful exploitation of this SSRF vulnerability can have several serious consequences. Attackers can gain unauthorized access to internal network services and sensitive data residing on the local machine or within the internal network. Credential leakage, due to the inclusion of usernames and passwords in the Authorization header, can lead to further compromise of other systems and services. Cloud metadata endpoints can be queried to obtain sensitive credentials for cloud environments (AWS, Azure, GCP). Furthermore, by manipulating the response received from the attacker-controlled server, arbitrary data can be injected into the Glances application, potentially leading to further exploitation or disruption of services.

Recommendation

Deploy the following Sigma rule to detect modifications to the Glances configuration file to identify potential exploitation attempts.
Apply input validation to the public_api configuration parameter within the Glances IP plugin to enforce scheme restrictions (http/https only) and validate the destination host, mitigating SSRF vulnerabilities as detailed in the overview.
Implement network segmentation to limit the impact of successful SSRF attacks by restricting access to internal resources from the Glances server.
Monitor network connections originating from the Glances server for suspicious outbound traffic to internal or cloud metadata IP ranges.

Glances Command Injection Vulnerability via Dynamic Configuration

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

Glances, a system monitoring tool, contains a command injection vulnerability in versions 4.5.2 and earlier. The vulnerability stems from the dynamic configuration parsing in Config.get_value(), where substrings enclosed in backticks are interpreted and executed as system commands. This behavior occurs without proper validation or restriction, allowing an attacker to inject arbitrary commands. If an attacker can modify or influence the Glances configuration files, these commands will execute automatically with the privileges of the Glances process. This is particularly concerning in deployments where Glances runs with elevated privileges, such as when it is configured as a system service. The vulnerability is tracked as CVE-2026-33641.

Attack Chain

Attacker gains access to the Glances configuration file (e.g., through misconfigured file permissions, shared writable directories, or compromised configuration management systems).
Attacker modifies the configuration file to include a malicious command within backticks in a configuration value (e.g., url_prefix = 'id').
Glances is started or the configuration is reloaded.
During configuration parsing, the Config.get_value() function in glances/config.py identifies the backtick-enclosed substring.
The identified command is extracted and passed to the system_exec() function in glances/globals.py.
system_exec() executes the command using subprocess.run() effectively running the injected code on the host.
The output of the executed command replaces the original configuration value.
The attacker achieves arbitrary command execution with the privileges of the Glances process, potentially leading to privilege escalation if Glances runs with elevated permissions.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the system with the privileges of the Glances process. If Glances is running as root or another privileged user, this can lead to full system compromise and privilege escalation. The vulnerability affects any system where Glances versions 4.5.2 or earlier is installed and the configuration file is modifiable by a malicious actor. Scenarios include misconfigured file permissions allowing unauthorized config modification, shared systems where configuration directories are writable by multiple users, container environments with mounted configuration volumes, and automated configuration management systems that ingest untrusted data.

Recommendation

Upgrade Glances to a version greater than 4.5.2 to patch CVE-2026-33641.
Implement strict file permission controls on Glances configuration files to prevent unauthorized modification (reference Attack Chain step 1).
Deploy the Sigma rule Detect Glances Configuration Command Injection to detect attempts to exploit this vulnerability by monitoring process creation events after config file modification.
Monitor file integrity of Glances configuration files using a file integrity monitoring (FIM) system and alert on unauthorized changes to configuration files (reference Attack Chain step 2).