GHSA-59fj-m2j6-hcxh

Описание

Summary

In Glances 4.5.5 the --disable-config-exec flag was extended (GHSA-3vwc-qwhc-3mj7) to stop secure_popen() from interpreting the shell operators &&, | and > in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its command lines from the same configuration file. As a result, with --disable-config-exec enabled, a configured alert action that contains > (file redirection), && (chaining) or | (pipe) still has those operators interpreted, allowing arbitrary file write / command chaining at the privilege of the glances process when the alert triggers.

Affected code

glances/actions.py (Glances 4.5.5, latest):

By contrast the AMP modules were fixed:

PoC (benign)

glances.conf:

Run glances --disable-config-exec and generate CPU load. When the cpu user alert reaches CRITICAL, /tmp/poc_marker is created — i.e. the > operator was interpreted despite --disable-config-exec. The same > in an [amp_*] command value is correctly not interpreted.

Impact

Arbitrary file write (>), command chaining (&&) and pipe (|) from config-defined alert actions, contrary to the guarantee of --disable-config-exec. Trust boundary = the glances configuration file.

Suggested fix

Pass allow_operators=not args.disable_config_exec from GlancesActions.run() into secure_popen() (GlancesActions already holds args).

Credit

Reported via responsible-disclosure incomplete-fix measurement study.