GHSA-x46r-mf5g-xpr6

Описание

Summary

The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names.

Root Cause: The normalize() function uses f"'{value}'" for string values without escaping single quotes within the value. The resulting strings are concatenated into INSERT queries via string formatting and executed directly with cur.execute() — no parameterized queries are used.

Affected Code

• File: glances/exports/glances_timescaledb/init.py, lines 79-93 (normalize function)

• File: glances/exports/glances_timescaledb/init.py, lines 201-205 (query construction)

PoC

• As a normal user, create a process with the name containing the SQL Injection payload:

• Start Glances with TimescaleDB export as root user:

• Observe that sqli_proof.txt is created in /tmp directory.

Impact

• Data Destruction: DROP TABLE, DELETE, TRUNCATE operations against the TimescaleDB database.
• Data Exfiltration: Using COPY ... TO or subqueries to extract data from other tables.
• Potential RCE: Via PostgreSQL extensions like COPY ... PROGRAM which executes OS commands.
• Privilege Escalation: Any local user who can create a process with a crafted name can inject SQL into the database, potentially compromising the entire PostgreSQL instance.