Glances Exposes Unauthenticated Configuration Secrets

@@ -17,6 +17,19 @@
 from glances.globals import BSD, LINUX, MACOS, SUNOS, WINDOWS, ConfigParser, NoOptionError, NoSectionError, system_exec
 from glances.logger import logger
 
+# Sections entirely blocked from the secure view
+_SECURE_BLOCKED_SECTIONS = frozenset(
+    {
+        "passwords",
+    }
+)
+
+# Key name patterns redacted in any section
+_SECURE_SENSITIVE_KEY_RE = re.compile(
+    r"password|token|secret|api_key|apikey|ssl_keyfile",
+    re.IGNORECASE,
+)
+
 
 def user_config_dir():
     r"""Return a list of per-user config dir (full path).
@@ -286,6 +299,22 @@ def as_dict(self):
                 dictionary[section][option] = self.parser.get(section, option)
         return dictionary
 
+    def as_dict_secure(self):
+        """Return a sanitised copy of the configuration dict.
+
+        Intended for unauthenticated API access.
+        - Blocked sections are omitted entirely.
+        - Sensitive keys in remaining sections are replaced by '********'.
+        """
+        sanitized = {}
+        for section, options in self.as_dict().items():
+            if section in _SECURE_BLOCKED_SECTIONS:
+                continue
+            sanitized[section] = {
+                key: "********" if _SECURE_SENSITIVE_KEY_RE.search(key) else value for key, value in options.items()
+            }
+        return sanitized
+
     def sections(self):
         """Return a list of all sections."""
         return self.parser.sections()

@@ -1165,7 +1165,7 @@ def _api_config(self):
         """
         try:
             # Get the RAW value of the config' dict
-            args_json = self.config.as_dict()
+            args_json = self.config.as_dict() if self.args.password else self.config.as_dict_secure()
         except Exception as e:
             raise HTTPException(status.HTTP_404_NOT_FOUND, f"Cannot get config ({str(e)})")
         else:
@@ -1179,7 +1179,7 @@ def _api_config_section(self, section: str):
         HTTP/400 if item is not found
         HTTP/404 if others error
         """
-        config_dict = self.config.as_dict()
+        config_dict = self.config.as_dict() if self.args.password else self.config.as_dict_secure()
         if section not in config_dict:
             raise HTTPException(status.HTTP_400_BAD_REQUEST, f"Unknown configuration item {section}")
 
@@ -1199,7 +1199,7 @@ def _api_config_section_item(self, section: str, item: str):
         HTTP/400 if item is not found
         HTTP/404 if others error
         """
-        config_dict = self.config.as_dict()
+        config_dict = self.config.as_dict() if self.args.password else self.config.as_dict_secure()
         if section not in config_dict:
             raise HTTPException(status.HTTP_400_BAD_REQUEST, f"Unknown configuration item {section}")