HiSecOS Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in HiSecOS version 04.0.01, allowing authenticated users to alter their access roles via XML-based NETCONF configuration. By sending specially crafted XML payloads to the /mops_data endpoint, users can elevate their privileges to administrative levels.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users to gain administrative rights.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to the /mops_data endpoint with an XML payload that includes a specific role value. The payload must be crafted to modify the user's access role to 'admin'.