A critical CORS misconfiguration in Glances prior to version 4.5.2 allows unauthenticated attackers to perform cross-site data theft, potentially exposing system configuration and secrets.

The Glances REST API utilizes a permissive CORS configuration that reflects the request Origin header when allow_credentials is set to true. This allows an unauthenticated, remote attacker to bypass cross-origin protections and access sensitive system monitoring data via a user's active browser session.

The exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive system information, including configuration secrets and command line arguments. With a CVSS score of 8.1, this high-severity flaw facilitates significant data exfiltration risks that could compromise the integrity and confidentiality of the entire monitoring environment.

Immediate Action: Update the Glances package to version 4.5.2 or later to apply the corrected CORS middleware configuration.

Proactive Monitoring: Review web server access logs for anomalous cross-origin requests originating from untrusted domains.

Compensating Controls: If immediate patching is not possible, implement a Web Application Firewall (WAF) to restrict access to the Glances REST API and enforce strict CORS origin policies at the network edge.

Public Exploit Available: Unknown

Given the potential for unauthorized access to sensitive system secrets and monitoring data, organizations should prioritize the deployment of the 4.5.2 patch across all Glances instances. The combination of unauthenticated access and the ability to steal credentialed data makes this a high-priority remediation task to prevent potential reconnaissance or credential theft.