GHSA-hhcg-r27j-fhv9: Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
SummaryGlances recently added DNS rebinding protection for the MCP endpoint, but the main REST/WebUI FastAPI application still accepts arbitrary `Host` headers and does not apply `TrustedHostMiddleware` or an equivalent host allowlist.As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin.This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target.DetailsThe MCP endpoint now has explicit host-based transport security:However, the main FastAPI application for REST/WebUI/token routes is initialized without any host validation middleware:There is no `TrustedHostMiddleware`, no comparison against the configured bind host, and no allowlist enforcement for HTTP `Host` values on the REST/WebUI surface.The default bind configuration also exposes the service on all interfaces:This combination means the HTTP service will typically be reachable from the victim machine under an attacker-selected hostname once DNS is rebound to the Glances listener.The token endpoint is also mounted on the same unprotected FastAPI app:Why This Is ExploitableIn a DNS rebinding attack:The attacker serves JavaScript from `https://attacker.example`.The victim visits that page while a Glances instance is reachable on the victim network.The attacker's DNS for `attacker.example` is rebound from the attacker's server to the Glances IP address.The victim browser now sends same-origin requests to `https://attacker.example`, but those requests are delivered to Glances.Because the Glances REST/WebUI app does not validate the `Host` header or enforce an allowed-host policy, it serves the response.The attacker-controlled JavaScript can read the response as same-origin content.The MCP code already acknowledges this threat model and implements host-level defenses. The REST/WebUI code path does not.Proof of ConceptThis issue is code-validated by inspection of the current implementation:REST/WebUI/token are all mounted on a plain `FastAPI(...)` appno `TrustedHostMiddleware` or equivalent host validation is applieddefault bind is `0.0.0.0`MCP has separate rebinding protection, showing the project already recognizes the threat modelIn a live deployment, the expected verification is:And if the operator exposes Glances without `--password` (supported and common), the attacker can read endpoints such as:Even on password-enabled deployments, the missing host validation still leaves the REST/WebUI/token surface reachable through rebinding and increases the value of chains with other authenticated browser issues.Impact**Remote read of local/internal REST data:** DNS rebinding can expose Glances instances that were intended to be reachable only from a local or internal network context.**Bypass of origin-based browser isolation:** Same-origin policy no longer protects the API once the browser accepts the attacker-controlled rebinding host as the origin.**High-value chaining surface:** This expands the exploitability of previously identified Glances issues involving permissive CORS, credential-bearing API responses, and state-changing authenticated endpoints.**Token surface exposure:** The JWT token route is mounted on the same host-unvalidated app and is therefore also reachable through the rebinding path.Recommended FixApply host allowlist enforcement to the main REST/WebUI FastAPI app, similar in spirit to the MCP hardening:At minimum:reject requests whose `Host` header does not match an explicit allowlistdo not rely on `0.0.0.0` bind semantics as an access-control boundarydocument that reverse-proxy deployments must set a strict host allowlistReferences`glances/outputs/glances_mcp.py``glances/outputs/glances_restful_api.py``glances/main.py`
CVSS v3.1: 5.9