Executive Summary

This vulnerability exists in the Glances system monitoring tool versions prior to 4.5.5. Specifically, the XML-RPC server component does not validate the HTTP Host header, which makes it susceptible to DNS rebinding attacks.

DNS rebinding allows an attacker to manipulate the victim's browser to bypass same-origin policies and access internal services. In this case, an attacker can exploit this flaw to exfiltrate the full system monitoring dataset from the victim's browser.

The issue is fixed in version 4.5.5 of Glances.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to exfiltrate sensitive system monitoring data, including hostnames, OS details, process lists with potential credentials, and other system metrics, by exploiting DNS rebinding attacks on the Glances XML-RPC server.

Such unauthorized access and potential data leakage could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over the confidentiality and security of sensitive information.

Because the vulnerability results in a high confidentiality impact, organizations using affected versions of Glances may face compliance risks if sensitive or personal data is exposed through this flaw.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Glances XML-RPC server not validating the HTTP Host header, which can be detected by checking if the Glances XML-RPC server is running and accessible on your system or network.

To detect the presence of the vulnerable Glances XML-RPC server, you can scan for open ports commonly used by Glances (default is 61209) and attempt to send HTTP requests with arbitrary Host headers to see if the server accepts them without validation.

Example commands to detect the vulnerable service include:

• Use netstat or ss to check if Glances server is listening on the default port (61209): - netstat -tuln | grep 61209 - ss -tuln | grep 61209
• Use curl to send a request with a custom Host header to the Glances XML-RPC server: - curl -v -H "Host: malicious.example.com" http://localhost:61209
• If the server responds without rejecting the Host header, it indicates the vulnerability is present.

Additionally, review your Glances version; versions prior to 4.5.5 are vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can extract sensitive system monitoring data from your device by tricking your browser through DNS rebinding.

This could lead to unauthorized disclosure of system information, which might be used for further attacks or to gain insights into your system's status and configuration.

However, the attack requires user interaction (UI:R) and has a high attack complexity (AC:H), meaning it is not trivial to exploit.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Glances to version 4.5.5 or later, where the issue with HTTP Host header validation has been fixed.

Useful 0 Not Useful 0