Glances CVE-2024-68518 Command Injection Bypass via Cross-Field Shell-Operator Reconstruction

Vulnerability Overview Vulnerability Name: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction CVE ID: CVE-2024-68518 Description: The system in Glances allows administrators to configure shell commands to be executed when monitoring thresholds are triggered. The command is a Mustache template, where its variables are populated by runtime state fields (such as process names, container names, or filesystem mount points). These fields are attacker-controllable because attackers can control process names and command lines. The rendered command is executed by , which interprets chaining/pipe/redirection operators such as , , and . defends against this issue via the function, which removes shell operators from each template value prior to rendering. However, across the boundary of two adjacent template variables, operators are recombined after Mustache rendering. When an action template concatenates two unescaped variables (e.g., or ), an attacker can end the first value with and begin the second value with , resulting in a rendered command containing a genuine . Since executes this injected command, it results in command injection. A single within each value remains untouched by the per-field filter. Scope of Impact Affected Versions: (Verified against published PyPI version 4.5.5, which is the latest as of this writing). is "4.5.5". The per-field filter is present and active in this version. This vulnerability has not been patched in any released version. Required Privileges: Two roles are required: - A local unprivileged user (or an attacker who can name a container) provides attacker-controlled stat values (process name/container name, mount points, etc.). This constitutes the boundary for action template command injection, where the attacker controls the process name rather than the configuration. - An administrator configures an action whose command template concatenates two unescaped Mustache variables without a separating character (e.g., ). Unescaped Mustache and are documented Mustache features and are a natural choice for attackers wishing to have operator values contain shell-significant characters to reach the command directly. Network Access: No network access to the target host is required; only the ability to run processes (or launch named containers) is needed. Remediation Recommended Fix: Enforce operator prohibition on the rendered command string derived from template variable expansion, rather than on pre-rendered values. One approach mimics the existing helper function: render each variable, then reject/neutralize operators in the concatenated result that originate from variable data. Neutralizing single (as well as single or ) within each value eliminates cross-field reconstruction, as no operator characters survive across variable boundaries. Alternatively, neutralize after , or pass template-derived data as when the command originates from stat-field substitution. POC Code Captured Output (glances 4.5.5, Python 3.13, x86_64 Linux): The negative control confirms that identical template values are blocked under a standard double-brace template (chevron escapes ). The positive case demonstrates injected execution when the template uses two adjacent unescaped variables: the file is created by the injected command, rather than the expected action.

Goal Reached Thanks to every supporter — we hit 100%!

Glances CVE-2024-68518 Command Injection Bypass via Cross-Field Shell-Operator Reconstruction

More from this source