H3C M2 NAS Unnecessary Privileges Vulnerability in Webserver Configuration

A vulnerability exists in the H3C M2 NAS V100R006 model, related to the webserver configuration component. This vulnerability allows for execution with unnecessary privileges, potentially leading to unauthorized access or actions. The issue arises from an insecure configuration that grants root permissions to both User and Group properties in the webserver's boa configuration file. As a result, any exploitation of the web interface could immediately provide root access, compromising the entire device. This vulnerability can only be exploited locally, and while the attack's complexity is high, a public exploit is available.

Impact

Exploitation of this vulnerability could lead to total compromise of the device, allowing an attacker to gain root access and control over the system.