Bareos up to 21.1.10/22.1.5/23.0.3 ACL improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in Bareos up to 21.1.10/22.1.5/23.0.3. This issue affects some unknown processing of the component ACL. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2024-45044. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Bareos up to 21.1.10/22.1.5/23.0.3. Affected is an unknown functionality of the component ACL. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command in bconsole using an abbreviation (i.e. "w" for "whoami") the ACL check did not apply to the full form (i.e. "whoami") but to the abbreviated form (i.e. "w"). If the command ACL is configured with negative ACL that should forbid using the "whoami" command, you could still use "w" or "who" as a command successfully. Fixes for the problem are shipped in Bareos versions 23.0.4, 22.1.6 and 21.1.11. If only positive command ACLs are used without any negation, the problem does not occur.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-45044 since 08/21/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 21.1.11, 22.1.6 or 23.0.4 eliminates this vulnerability. Applying the patch 2a026698b87d13bd1c6275726b5e826702f81dd5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Bareos

Version

• 21.1.0
• 21.1.1
• 21.1.2
• 21.1.3
• 21.1.4
• 21.1.5
• 21.1.6
• 21.1.7
• 21.1.8
• 21.1.9
• 21.1.10
• 22.1.0
• 22.1.1
• 22.1.2
• 22.1.3
• 22.1.4
• 22.1.5
• 23.0.0
• 23.0.1
• 23.0.2
• 23.0.3

License

• open-source

Website

• Product: https://github.com/bareos/bareos/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion