| Package | Affected versions | Patched versions |
|---|---|---|
| glances | < 4.5.2 | 4.5.2 |
| glances | < 4.5.2 | 4.5.2 |
Glances recently added DNS rebinding protection for the MCP endpoint, but the main REST/WebUI FastAPI application still accepts arbitrary Host headers and does not apply TrustedHostMiddleware or an equivalent host allowlist.
As a result, the REST API, WebUI, and token endpoint remain reachable through attacker-controlled domains in classic DNS rebinding scenarios. Once the victim browser has rebound the attacker domain to the Glances service, same-origin policy no longer protects the API because the browser considers the rebinding domain to be the origin.
This is a distinct issue from the previously reported default CORS weakness. CORS is not required for exploitation here because DNS rebinding causes the victim browser to treat the malicious domain as same-origin with the rebinding target.
The MCP endpoint now has explicit host-based transport security:
# glances/outputs/glances_mcp.py
self.mcp_allowed_hosts = ["localhost", "127.0.0.1"]
...
return TransportSecuritySettings(
allowed_hosts=allowed_hosts,
allowed_origins=allowed_origins,
)
However, the main FastAPI application for REST/WebUI/token routes is initialized without any host validation middleware:
# glances/outputs/glances_restful_api.py
self._app = FastAPI(default_response_class=GlancesJSONResponse)
...
self._app.add_middleware(
CORSMiddleware,
allow_origins=config.get_list_value('outputs', 'cors_origins', default=["*"]),
allow_credentials=config.get_bool_value('outputs', 'cors_credentials', default=True),
allow_methods=config.get_list_value('outputs', 'cors_methods', default=["*"]),
allow_headers=config.get_list_value('outputs', 'cors_headers', default=["*"]),
)
...
if self.args.password and self._jwt_handler is not None:
self._app.include_router(self._token_router())
self._app.include_router(self._router())
There is no TrustedHostMiddleware, no comparison against the configured bind host, and no allowlist enforcement for HTTP Host values on the REST/WebUI surface.
The default bind configuration also exposes the service on all interfaces:
# glances/main.py
parser.add_argument(
'-B',
'--bind',
default='0.0.0.0',
dest='bind_address',
help='bind server to the given IPv4/IPv6 address or hostname',
)
This combination means the HTTP service will typically be reachable from the victim machine under an attacker-selected hostname once DNS is rebound to the Glances listener.
The token endpoint is also mounted on the same unprotected FastAPI app:
# glances/outputs/glances_restful_api.py
def _token_router(self) -> APIRouter:
...
router.add_api_route(f'{base_path}/token', self._api_token, methods=['POST'], dependencies=[])
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeIn a DNS rebinding attack:
https://attacker.example.attacker.example is rebound from the attacker's server to the Glances IP address.https://attacker.example, but those requests are delivered to Glances.Host header or enforce an allowed-host policy, it serves the response.The MCP code already acknowledges this threat model and implements host-level defenses. The REST/WebUI code path does not.
This issue is code-validated by inspection of the current implementation:
FastAPI(...) appTrustedHostMiddleware or equivalent host validation is applied0.0.0.0In a live deployment, the expected verification is:
# Victim-accessible Glances service
glances -w
# Attacker-controlled rebinding domain first resolves to attacker infra,
# then rebinds to the victim-local Glances IP.
# After rebind, attacker JS can fetch:
fetch("http://attacker.example:61208/api/4/status")
.then(r => r.text())
.then(console.log)
And if the operator exposes Glances without --password (supported and common), the attacker can read endpoints such as:
GET /api/4/status
GET /api/4/all
GET /api/4/config
GET /api/4/args
GET /api/4/serverslist
Even on password-enabled deployments, the missing host validation still leaves the REST/WebUI/token surface reachable through rebinding and increases the value of chains with other authenticated browser issues.
Apply host allowlist enforcement to the main REST/WebUI FastAPI app, similar in spirit to the MCP hardening:
from starlette.middleware.trustedhost import TrustedHostMiddleware
allowed_hosts = config.get_list_value(
'outputs',
'allowed_hosts',
default=['localhost', '127.0.0.1'],
)
self._app.add_middleware(TrustedHostMiddleware, allowed_hosts=allowed_hosts)
At minimum:
Host header does not match an explicit allowlist0.0.0.0 bind semantics as an access-control boundaryglances/outputs/glances_mcp.pyglances/outputs/glances_restful_api.pyglances/main.py