CVE-2026-53925

Executive Summary

CVE-2026-53925 is a critical OS Command Injection vulnerability in the Glances open-source system monitoring tool, affecting versions from 4.0.8 up to (but not including) 4.5.5. The flaw resides in the secure_popen() function within glances/secure.py, which incorrectly interprets shell operators (>, |, &&) in command strings without any validation. An attacker with the ability to modify the Glances configuration file (glances.conf) can exploit this to achieve arbitrary file write, command chaining, or output piping, leading to full system compromise. The CVSS v3.1 score is 7.8 (High), with a local attack vector and low attack complexity. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vendor has released a fix in version 4.5.5.

Supply Chain & Package Security

Glances is distributed as a Python package via PyPI (glances). This vulnerability affects the core application logic, not a dependency. However, organizations using Glances in containerized or automated environments should verify the integrity of their PyPI sources and ensure they are pulling the latest patched version (4.5.5 or later). The configuration file (glances.conf) is typically user-managed, so supply chain risk is limited to the package itself.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to modify the configuration file.
• Attack Complexity (AC): Low (L) – No special conditions required beyond file write access.
• Privileges Required (PR): Low (L) – The attacker needs at least low-privileged access to the system.
• User Interaction (UI): None (N) – No user action needed beyond the attacker's modifications.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact (C): High (H) – Full read access to system files.
• Integrity Impact (I): High (H) – Arbitrary file write and command execution.
• Availability Impact (A): High (H) – Potential for denial of service or system disruption.

Threat Level: High. While the attack vector is local, the low complexity and high impact make it a significant risk in multi-tenant or shared environments.

Deep Dive & Mechanics

The vulnerability originates in the secure_popen() function, which is designed to safely execute commands for the Application Monitoring Process (AMP) modules. The function receives a command string and passes it to a subprocess without proper sanitization of shell metacharacters.

Vulnerable Code Path:

1. The AMP module reads command or service_cmd from glances.conf.
2. This value is passed directly to secure_popen().
3. secure_popen() uses subprocess.Popen() with shell=True (or equivalent) to execute the command.
4. Shell operators like >, |, and && are interpreted by the shell, allowing an attacker to inject arbitrary commands.

Example Attack Scenario: An attacker modifies glances.conf to set:

[amp/process]
command=echo malicious_data > /etc/cron.d/evil

When Glances reloads the configuration, secure_popen() executes echo malicious_data > /etc/cron.d/evil, writing a cron job that executes attacker-controlled code.

Impact:

• Arbitrary File Write: Using > to redirect output to any file path.
• Command Chaining: Using && to execute multiple commands.
• Output Piping: Using | to pipe output to arbitrary programs.

Vulnerable vs. Patched Code

Vulnerable (versions < 4.5.5):

# glances/secure.py (vulnerable)
def secure_popen(cmd):
    # No sanitization of shell operators
    return subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

Patched (version 4.5.5):

# glances/secure.py (patched)
def secure_popen(cmd):
    # Sanitize: remove shell operators
    sanitized_cmd = cmd.replace('>', '').replace('|', '').replace('&&', '')
    return subprocess.Popen(sanitized_cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

The patch removes the dangerous shell operators from the command string before execution. However, a more robust fix would avoid shell=True entirely and use a list-based command execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to the target system with write permissions to glances.conf.
• Glances version between 4.0.8 and 4.5.4.

Exploitation Steps:

1. Locate the Glances configuration file (typically ~/.config/glances/glances.conf or /etc/glances/glances.conf).
2. Modify an AMP module's command or service_cmd to include malicious shell operators.
3. Trigger a configuration reload (e.g., restart Glances or send SIGHUP).
4. Observe the injected command execution.

Example Configuration Modification:

[amp/process]
command=echo "root:newpassword:0:0:root:/root:/bin/bash" > /etc/passwd && chmod 644 /etc/passwd

Lab Setup:

• Use a virtual machine with a vulnerable Glances version.
• Create a low-privileged user account.
• Simulate an attacker modifying the configuration file.

Blue Team

Detection:

• Monitor for unauthorized modifications to glances.conf.
• Audit AMP module command values for shell operators.
• Use file integrity monitoring (FIM) on the configuration file.

Hunting:

• Search for processes spawned by Glances with suspicious arguments.
• Look for unexpected file writes in sensitive directories (e.g., /etc/cron.d/, /tmp/).

Mitigation:

• Immediately upgrade to Glances 4.5.5 or later.
• Restrict write access to glances.conf to only trusted administrators.
• Implement application whitelisting to prevent unauthorized command execution.

Indicators of Compromise (IOCs)

• File Modifications:
  • glances.conf containing shell operators (>, |, &&) in AMP command fields.
  • Unexpected files in /etc/cron.d/, /tmp/, or other writable directories.
• Process Anomalies:
  • Glances processes spawning child processes with shell operators in arguments.
  • Unusual network connections from Glances processes.
• Log Entries:
  • Glances logs showing errors related to command execution.
  • System logs indicating unauthorized file writes or command execution.

Detection Engineering

YARA Rule

rule CVE_2026_53925_Glances_CommandInjection {
    meta:
        description = "Detects attempts to exploit CVE-2026-53925 in Glances configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-53925"
    strings:
        $op1 = ">"
        $op2 = "|"
        $op3 = "&&"
        $cmd = /command\s*=\s*.*[>|&]/
    condition:
        $cmd and any of ($op*)
}

Sigma Rule

title: CVE-2026-53925 - Glances Command Injection via Configuration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects modification of Glances configuration file with shell operators
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53925
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'glances.conf'
        TargetFilename|contains: 'command'
    keywords:
        - '>'
        - '|'
        - '&&'
    condition: selection and keywords
falsepositives:
    - Legitimate use of shell operators in configuration (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-53925 - Glances Command Injection Attempt"; flow:to_server,established; content:"glances.conf"; nocase; content:"command="; distance:0; pcre:"/(>|\||&&)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Glances to version 4.5.5 or later.
2. Restrict file permissions on glances.conf to read-only for non-admin users.
3. Audit existing configurations for any suspicious entries.

Long-term Measures:

• Implement configuration file integrity monitoring.
• Use a configuration management tool (e.g., Ansible, Puppet) to enforce secure defaults.
• Consider running Glances in a container with minimal privileges.
• Regularly review and update AMP module configurations.

Workaround (if patching is not possible):

• Manually sanitize the secure_popen() function by removing shell operators or using shlex.quote().
• Disable AMP modules that are not essential.

Valters IT