Technical impact
Glances by nicolargo includes an XML‑RPC server that, when enabled with glances -s or glances --server, emits an Access‑Control‑Allow‑Origin: * header on every response without validating the Content‑Type of incoming requests. An attacker can craft a simple POST request with a text/plain Content‑Type and a valid XML‑RPC payload. The victim’s browser forwards the request and, because the response carries the wildcard CORS header, the attacker’s JavaScript can read the returned data. The data set contains hostname, operating system, network interfaces, CPU, memory, storage, and the full list of processes with command arguments, which often include secrets. The flaw is identified as CWE‑942 and allows remote disclosure of comprehensive system state.
Affected Systems
All nicolargo Glances releases prior to 4.5.3 that run the XML‑RPC server are affected. The vulnerability exists whenever the XML‑RPC mode is enabled, meaning any instance of the tool operating in server mode is at risk.
Risk and Exploitability
The CVSS v3.1 score of 7.1 indicates high severity, while an EPSS estimate of less than 1% suggests limited current exploitation activity. The issue does not appear in the CISA KEV catalog. The likely attack vector, inferred from the description, is a browser‑based exploit where an attacker hosts a malicious web page that issues a CORS‑enabled POST to the vulnerable endpoint; the victim’s browser will forward the request and grant the attacker access to the sensitive data.
Github GHSA