PT-2024-31395 · Bareos · Bareos

Published 2024-09-10 · Updated 2024-09-14 · CVE-2024-45044

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bareos versions prior to 21.1.11 Bareos versions prior to 22.1.6 Bareos versions prior to 23.0.4

Description The issue concerns the command ACL in Bareos, where command restrictions can be bypassed using abbreviations. When a command ACL is in place and a user executes a command in bconsole using an abbreviation, the ACL check applies to the abbreviated form instead of the full form. This allows users to execute commands that should be forbidden by the ACL. The problem does not occur if only positive command ACLs are used without any negation.

Recommendations For versions prior to 21.1.11, update to version 21.1.11 or later. For versions prior to 22.1.6, update to version 22.1.6 or later. For versions prior to 23.0.4, update to version 23.0.4 or later. As a temporary workaround, consider disabling the use of abbreviated commands in bconsole until a patch is available. Restrict access to the command ACL component to minimize the risk of exploitation. Avoid using negative ACLs with abbreviations in the command ACL configuration until the issue is resolved.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-45044

GHSA-JFWW-Q346-R2R8

Affected Products

Bareos

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45044.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-45044 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45044 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-45044 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45044 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45044 · Vendor Advisory
• https://github.com/bareos/bareos/pull/1875 · Note
• https://github.com/bareos/bareos/security/advisories/GHSA-jfww-q346-r2r8 · Note
• https://github.com/bareos/bareos/commit/2a026698b87d13bd1c6275726b5e826702f81dd5 · Note
• https://twitter.com/oktsec/status/1833554583781548057 · Twitter Post
• https://t.me/cvedetector/5240 · Telegram Post
• https://twitter.com/cracbot/status/1835196956110733661 · Twitter Post
• https://twitter.com/CVEnew/status/1833549069798838504 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1833552704129400887 · Twitter Post
• https://twitter.com/CveFindCom/status/1833529383698456855 · Twitter Post