Hyperglass pre-auth RCE: unescaped str.format() target injection — unauthenticated shell on exposed looking-glass instances (no CVE)
Severity: critical · Patch status: partial · Since 2026-11-10
Hyperglass, a popular looking-glass front end, passes the user-supplied query target into router command templates via bare str.format() with no shell escaping. Three vectors: FRR AS-path quote injection, BIRD IPv6 scope-ID injection (fe80::1%;id passes Python ipaddress validation and lands unquoted in ping -6), and Cisco IOS newline injection (emulator-proven). POST /api/query/ is unauthenticated by default, so any exposed instance yields pre-auth command execution as the service user. A PeeringDB/Shodan sweep found 388 live instances; 36 hosts across 20 ASNs confirmed with command execution, 11 root or root-equivalent, enabling route injection, BGP session resets, credential reuse, and backup/guest-disk access. Tracked upstream as issue 383 / PR 382, open since July 2026; a three-line fix is not yet released.
What to do
- Patch or take internet-exposed hyperglass instances offline immediately; apply the upstream fix (issue #383 / PR #382) if no release exists
- Restrict /api/query/ behind authentication or network ACLs
- Rotate SSH keys, service passwords and credentials on affected hosts, including those reachable from compromised collectors
- Audit hosts for persistence (containers, tunnels, proxies, cron) and rebuild compromised systems rather than cleaning in place
- Check BGP state and route-reflector logs for injected/withdrawn routes and unexpected session resets
- Verify command templates and validators escape or quote targets on any custom platform definitions
Sources
All live incidents on Threat Watch
