One unescaped str.format(): 36 ISP and hosting footholds from a public looking glass

hyperglass is a looking-glass front end. You give it a target, it drops that target into a router command and hands the result to Netmiko. The target goes in with a bare str.format() and is never shell-escaped. On any platform where the command ends up in a Linux shell, the target stops being data.

A sweep of PeeringDB and Shodan for exposed hyperglass instances produced 36 hosts with command execution across 20 ASNs, 11 of them root or root-equivalent. Almost all are collectors and edge VMs, not core forwarding routers. None is a whole-AS compromise — but a lot of this is real infrastructure with reusable credentials behind it.

The bug

# hyperglass/execution/drivers/_construct.py:113
return command.format(target=self.target, mask=mask, **attrs)

The command templates look like this:

vtysh -c "show bgp ipv4 unicast regexp {target}"

The AS-path and community rules validate with a wildcard, so almost any string passes. Netmiko ships it to linux_ssh, and bash expands it.

Three ways it lands:

1. FRR AS-path injection. A quote closes the intended argument and $() or ; runs in the shell. Unauthenticated, this returns uid=1001(hyperglass) on Pombonet.

2. BIRD IPv6 scope-ID injection. Python's ipaddress accepts arbitrary text after the % of an IPv6 address, so fe80::1%;id passes validation as a scoped address. The original string is then inserted unquoted into ping -6 ... {target}, and bash reads the semicolon as a separator. Unauthenticated, this returns uid=1000(hyperglass) on SolNet.

3. Cisco IOS newline injection. An internal newline survives validation and the unquoted BGP community command turns into two CLI lines. The second line goes to the router inside the already-authenticated SSH session, so 1.1.1.1\nclear ip bgp * shows the route and then clears BGP. This one is proven against an IOS emulator, not a live public target.

A second, independent reproduction against a clean revision pointing at a real OpenSSH shell returned the service UID and created a file via touch /tmp/pwned_hg. It is tracked upstream in #383 / PR #382, and has been open on the public repository for four months.

The scan

• 3,693 PeeringDB looking-glass URLs, plus Shodan queries
• 388 live hyperglass instances
• 36 confirmed hosts with command execution
• 11 root or root-equivalent
• 20 ASNs with writable routing state
• Mostly collectors; none is a forwarding core

What was reachable

Critical

High

Medium

lg.lsti.net (root, BGP MD5s), lg.suble.io (root, NOPASSWD), lg.sky.wf (root, 166 peers), lg.lumaserv.com (root), 45.165.244.14 (root), lg.6project.org (root), lg.jmjropc.com (birdc, unauthenticated Caddy API), lg.lge.isp.as210349.net (3.2M routes), lg.allnodes.com, 24it.pl, lg.flokinet.is, 191.5.112.142.

Read-only intel

194.110.61.121 routing.info, with key access to seven collectors (Arelion, Cogent, DTAG, DE-CIX, AMS-IX, BCIX, Iraq), full tables and daily MRT. Plus Nebula, Nexthop, PhoenixNet and Clientco.

What it can actually do

• Inject, withdraw or blackhole routes on 20 ASNs
• Reset BGP sessions and poison route-reflector state that then propagates over iBGP
• Shift paths toward K-root and transit peers
• Read and clone guest disks and backups on BizTelecom
• Reuse SSH keys and service passwords across hosts
• Pull full tables and MRT from three Tier-1 collectors
• Deploy proxies, containers, tunnels and persistence

Severity and urgency

Critical — both.

Eleven root or root-equivalent hosts, 20 ASNs with writable routing state, and a Proxmox cluster with 42 guests and its backups all sit behind a single unauthenticated endpoint. The access is credential-based, survives reboots, and stays quiet. Nothing gets rotated unless someone notices, so the footholds remain live and reusable indefinitely.

The only thing capping this below a national outage is that the hosts are collectors and edge nodes, not forwarding cores. Everything above that — host control, backup access, route injection, blackholing, session resets, RPKI poisoning — is in scope and chained across dozens of independent networks.

Urgency: act now. One unauthenticated POST reaches all of it. Rotate what can be rotated and rebuild what cannot, before the credentials age out or quietly get shared.

The list above is a floor, not a ceiling. 388 live instances turned up from a few thousand URLs, and only the reachable ones were followed up. The same three input paths exist on every unpatched deployment, so the real number of pwnable targets is almost certainly far higher. It has to be patched as soon as possible.

Caveats

• No whole-AS compromise
• No core router root
• Collectors are leaf nodes, not the dataplane
• Payment, SaaS and customer data are out of scope here
• The Cisco newline variant is emulator-tested, not live-proven

Closing

The bug is boring: one unescaped format call, a wildcard validator, and a shell underneath. The result is not. hyperglass is common, the directive ships built in, and /api/query is unauthenticated by default. Swap the target for $(id) and a looking glass becomes a shell.

This research was autonomously found by a swarm of agents running DeepSeek V4.1 Flash.