CVE-2024-45044: 
Bareos vulnerability analysis and mitigation

CVE-2024-45044 affects Bareos, an open source software for backup, archiving, and recovery of data. The vulnerability was discovered in the command ACL handling functionality, where command abbreviations could bypass ACL restrictions. The issue was disclosed on September 10, 2024 (GitHub Advisory).

When a command ACL is configured and a user executes a command in bconsole using an abbreviation (e.g., "w" for "whoami"), the ACL check was applied to the abbreviated form ("w") rather than the full command form ("whoami"). This allowed users to bypass negative ACL restrictions by using command abbreviations. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (GitHub Advisory).

If a command ACL is configured with negative ACL that should forbid using specific commands (e.g., "whoami"), users could still execute these commands by using abbreviations (e.g., "w" or "who"), effectively bypassing the security restrictions (GitHub Advisory).

The vulnerability affects Bareos versions 23.0.0 to 23.0.4, 22.0.0 to 22.1.6, and versions prior to 21.1.11. Exploitation requires network access and low privileges, but no user interaction (GitHub Advisory).

The vulnerability has been fixed in Bareos versions 23.0.4, 22.1.6, and 21.1.11. As a workaround, if only positive command ACLs are used without any negation, the problem does not occur (GitHub Advisory).