Cloudanix VulnDB

CVE-2024-45044

High · 8.8

CVSS

8.8

EPSS

0.5%

Published

Sep 10, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Backup software access rules could be skipped by typing short versions of commands, letting people run actions they were supposed to be blocked from.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The command ACL enforcement in the console interface applies checks only to abbreviated command forms rather than expanding them to full command names before evaluation, allowing negative ACL rules to be bypassed.

Why it matters to the business

Users intended to have restricted console access can execute commands they should be blocked from, increasing the risk of unauthorized backup operations or data exposure.

How an attack unfolds

An attacker authenticates to the console with an account subject to negative command ACLs, then submits a short abbreviation of a forbidden command; because the ACL check never sees the expanded form, the command succeeds and the restricted action is performed.

How to fix it

Upgrade Bareos to version 23.0.4, 22.1.6, or 21.1.11 (or the equivalent commit 2e70ad6e57fa7b3c1c52a8eb903b8ce6a633b7e7) where the ACL expansion occurs before rule evaluation.

How to confirm the fix worked

Confirm the installed version matches or exceeds the fixed releases, then test that negative ACL entries block both full and abbreviated command forms.

Typical attack path

  1. Obtain console access under a restricted ACL policy
  2. Issue an abbreviated command alias for a negatively ACL'd operation
  3. Bypass the incomplete ACL match and execute the action

How to detect it

Review console audit logs for command entries that use short aliases immediately followed by operations that should have been denied by negative ACLs; correlate with user sessions lacking full-command entries.

What your security team should do

  • Apply the listed version upgrades across all Bareos deployments
  • Audit existing command ACL configurations for any negative rules
  • Re-test console permissions after patching to verify abbreviation handling

The record

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command in bconsole using an abbreviation (i.e. "w" for "whoami") the ACL check did not apply to the full form (i.e. "whoami") but to the abbreviated form (i.e. "w"). If the command ACL is configured with negative ACL that should forbid using the "whoami" command, you could still use "w" or "who" as a command successfully. Fixes for the problem are shipped in Bareos versions 23.0.4, 22.1.6 and 21.1.11. If only positive command ACLs are used without any negation, the problem does not occur.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS bareos 0 No fix
Ubuntu:Pro:16.04:LTS bareos 0 No fix

Related vulnerabilities