PyPI · glances
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
Glances provides as_dict_secure() explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by '********'". However, the implementation only checks KEY names against a regex pattern and never inspects VALUE content. The documented [ip] config section supports public_api (URL), public_username (login), and public_password (password). While public_password is correctly masked, both public_api (when containing embedded credentials like https://user:pass@host/) and public_username are returned in full to unauthenticated users via GET /api/4/config.
Glances latest (Docker: nicolargo/glances:latest)
In glances/config.py, as_dict_secure():
_SECURE_SENSITIVE_KEY_RE = re.compile(r"password|token|secret|api_key|apikey|ssl_keyfile", re.IGNORECASE)
def as_dict_secure(self):
"""Return a sanitised copy of the configuration dict.
Intended for unauthenticated API access.
- Sensitive keys in remaining sections are replaced by '********'.
"""
sanitized = {}
for section, options in self.as_dict().items():
if section in _SECURE_BLOCKED_SECTIONS: continue
sanitized[section] = {
key: "********" if _SECURE_SENSITIVE_KEY_RE.search(key) else value
for key, value in options.items()
}
return sanitized
In glances/outputs/glances_restful_api.py:
# Line 1294
args_json = self.config.as_dict() if self.args.password else self.config.as_dict_secure()
The [ip] config section documents: public_api (URL), public_username (login), public_password (password).
public_password → matches "password" → masked ✓public_api → no match → returned in full (contains user:pass@ in URL) ✗public_username → no match → returned in full ✗GET /api/4/config or GET /api/4/config/ipas_dict_secure() exists specifically to protect credentials in no-auth mode but fails to mask public_username and credential-bearing URLs in public_api--password (default, no auth)glances.conf [ip] section with public_api containing embedded credentials and/or public_username setnicolargo/glances:latest)http://10.140.200.102:8080docker run -d --name glances-test -p 8080:61208 -e GLANCES_OPT='-w' nicolargo/glances:latest
sleep 20
docker exec glances-test sed -i 's|public_api=https://ipv4.ipleak.net/json/|public_api=https://admin:secret123@ipv4.ipleak.net/json/|' /etc/glances/glances.conf
docker exec glances-test sed -i 's|#public_username=<myname>|public_username=myname|' /etc/glances/glances.conf
docker exec glances-test sed -i 's|#public_password=<mysecret>|public_password=mysecret|' /etc/glances/glances.conf
docker restart glances-test
sleep 15
curl -s "$TARGET/api/4/config/ip"
# Returns: {"public_api": "https://admin:secret123@...", "public_username": "myname", "public_password": "********"}
See C:/Tools/glances-config-leak-evidence.txt.
as_dict_secure() value-level filtering gapAdd "username" and "login" to sensitive key pattern, and check values for embedded credentials in URLs.
GitHub username: Todor
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.