Vulnerability · Published Sep 10, 2024 · Assigned by GitHub_M

CVE-2024-45044Bareos's negative command ACLs can be circumvented by abbreviating commands

High 8.8

In plain English

A high-severity security flaw in bareos from bareos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 54.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command in bconsole using an abbreviation (i.e. "w" for "whoami") the ACL check did not apply to the full form (i.e. "whoami") but to the abbreviated form (i.e. "w"). If the command ACL is configured with negative ACL that should forbid using the "whoami" command, you could still use "w" or "who" as a command successfully. Fixes for the problem are shipped in Bareos versions 23.0.4, 22.1.6 and 21.1.11. If only positive command ACLs are used without any negation, the problem does not occur.

Affected products (as reported)

Vendor	Product	Versions
bareos	bareos	>= 23.0.0, < 23.0.4>= 22.0.0, < 22.1.6< 21.1.11

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/bareos/bareos/security/advisories/GHSA-jfww-q346-r2r8 x_refsource_CONFIRM
https://github.com/bareos/bareos/pull/1875 x_refsource_MISC
https://github.com/bareos/bareos/commit/2a026698b87d13bd1c6275726b5e826702f81dd5 x_refsource_MISC