| Título | D-link DGS-1100-08PD v1.00.006 Misconfiguration |
|---|
| Descripción | **Description:**
In `D-link DGS-1100-08PD`, there is a insecure configuration vulnerability. The device sets both `User` and `Group` property in the `boa` webserver configuration file to `root` permissions. This violates the principle of least privilege. Any exploit in the web interface can immediately grant root access, leading to total device compromise.
**Detail:**
In the `D-link DGS-1100-08PD` firmware, the partial content of `/etc/boa.conf` is as follows.
```
# User: The name or UID the server should run as.
# Group: The group name or GID the server should run as.
User 0
Group 0
```
Within, both `User` and `Group` properties are set to the `root` permissions. This violates the principle of least privilege.
The official documentation of boa (http://www.boa.org/documentation/boa-2.html) states the following requirements.
```
2.4 Security
Boa has been designed to use the existing file system security. In boa.conf, the directives user and group determine who Boa will run as, if launched by root. By default, the user/group is nobody/nogroup. This allows quite a bit of flexibility. For example, if you want to disallow access to otherwise accessible directories or files, simply make them inaccessible to nobody/nogroup. If the user that Boa runs as is "boa" and the groups that "boa" belongs to include "web-stuff" then files/directories accessible by users with group "web-stuff" will also be accessible to Boa.
```
Clearly, there is a misconfiguration vulnerability here. There is a significant security risk here. It is not set according to the officially recommended security configuration `nobody/nogroup`. This violates the principle of least privilege. Any exploit in the web interface can immediately grant root access, leading to total device compromise. |
|---|
| Fuente | ⚠️ https://www.notion.so/D-link-DGS-1100-08PD-v1-00-006-3670ed14e5cb80848bc4e3129dfafa29?source=copy_link |
|---|
| Usuario | yinfantasy (UID 98431) |
|---|
| Sumisión | 2026-05-21 10:51 (hace 19 días) |
|---|
| Moderación | 2026-06-08 07:53 (18 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 369165 [D-Link DGS-1100-08PD 1.00.006 Web Interface /etc/boa.conf] |
|---|
| Puntos | 17 |
|---|