GitHub Security Advisory: GHSA-7p93-6934-f4q7
Package: Glances (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Vulnerable versions: < 4.5.3
Patched in: 4.5.3

Summary: Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

Details:
### Summary

The Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response. The result is complete exfiltration of hostname, OS version, IP addresses, CPU/memory/disk/network stats, and the full process list including command lines (which often contain tokens, passwords, or internal paths).

### Details

File: glances/server.py, class GlancesXMLRPCHandler, line 41

```python
def send_my_headers(self):
    self.send_header("Access-Control-Allow-Origin", "*")
```

This header is attached to every response from the XML-RPC server. The server inherits from SimpleXMLRPCRequestHandler which parses the POST body as XML regardless of the Content-Type header. Combined with the default unauthenticated configuration (server.isAuth = False, line 196), any website on the internet can call getAll(), getPlugin(), getAllPlugins(), getAllLimits(), or getAllViews() and read the results.

The REST API had the same issue and it was fixed in 4.5.1 (CVE-2026-32610). The XML-RPC server was not patched. The two components are entirely separate code paths: the REST API uses FastAPI/Uvicorn and is started with glances -w, while the XML-RPC server uses Python's xmlrpc.server and is started with glances -s. The attack works because POST with Content-Type: text/plain is classified as a CORS simple request by browsers, so no OPTIONS preflight is sent. The server never checks the Content-Type value, so the XML-RPC payload inside a text/plain body is parsed and executed normally.

### PoC

Prerequisites: Glances installed (any version including latest 4.5.1+), started in server mode.

Step 1. Start the Glances XML-RPC server on the target machine:

```
glances -s -p 61209
```

Step 2. From any machine, run the Python PoC to confirm the issue server-side:

```
python3 poc_test.py TARGET_IP 61209
```

Step 3. To demonstrate the browser attack, host poc_cors_xmlrpc.html on any web server (even a different origin). Open it in a browser, enter the target URL (http://TARGET_IP:61209), and click "Steal System Data". The page will display the full system monitoring data retrieved cross-origin.

Step 4. Alternatively, paste this into any browser console while on any website:

```javascript
fetch("http://TARGET_IP:61209/RPC2", {
    method: "POST",
    headers: {"Content-Type": "text/plain"},
    body: '<?xml version="1.0"?><methodCall><methodName>getAll</methodName></methodCall>'
}).then(r => r.text()).then(d => {
    let m = d.match(/<string>([\s\S]*?)<\/string>/);
    let data = JSON.parse(m[1]