Executive Summary

This vulnerability exists in the Glances system monitoring tool's XML-RPC server prior to version 4.5.5. The server introduced a configurable CORS origin list in version 4.5.3 to mitigate a previous vulnerability. However, if the operator configures the CORS allowlist with more than one origin, the implementation incorrectly falls back to allowing all origins (Access-Control-Allow-Origin: *).

As a result, a malicious web page from any origin can send a CORS request to the /RPC2 endpoint and read the full system monitoring data without the user's knowledge, bypassing the intended restrictions.

This issue was fixed in Glances version 4.5.5.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthorized web pages from any origin to access sensitive system monitoring data exposed by the Glances XML-RPC server. This means an attacker can silently retrieve detailed system information without user consent or awareness.

Such unauthorized access can lead to information disclosure, potentially exposing system metrics and data that could be used for further attacks or reconnaissance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Glances to version 4.5.5 or later, where the issue is fixed.

Avoid configuring the CORS origin list with more than one entry in versions prior to 4.5.5, as this causes the server to fall back to an unrestricted wildcard, exposing sensitive system monitoring data.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Glances XML-RPC server allows any malicious web page to read the full system monitoring dataset without the victim's knowledge due to improper CORS origin handling.

This exposure includes sensitive system information such as hostname, OS details, process lists (which may contain credentials), CPU/memory/disk statistics, and container metadata.

Such unauthorized data exposure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require protection of sensitive and personal data against unauthorized access.

Therefore, organizations using vulnerable versions of Glances in XML-RPC server mode risk violating these standards due to potential data leakage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the Glances XML-RPC server mode (started with the command `glances -s`) when the configuration contains two or more entries in the cors_origins list. Detection involves verifying if the Glances server is running in XML-RPC mode and checking the cors_origins configuration.

To detect if your system is vulnerable, you can:

• Check if Glances is running in server mode with the command: `ps aux | grep 'glances -s'`
• Inspect the Glances configuration file (usually `~/.config/glances/glances.conf` or `/etc/glances/glances.conf`) for the `cors_origins` setting and see if it contains more than one origin.
• Use a network tool like curl to send a CORS request to the XML-RPC endpoint and observe the Access-Control-Allow-Origin header. For example: `curl -i -H "Origin: http://example.com" http://<glances-server-ip>:61208/RPC2` and check if the response header `Access-Control-Allow-Origin` is set to `*`.

If the server responds with `Access-Control-Allow-Origin: *` despite having multiple origins configured, the vulnerability is present.

Useful 0 Not Useful 0