CVE-2022-24755

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized.

CVSS v3.0 9.8 CRITICAL
CVSS v2.0 6.8 MEDIUM

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/bareos/bareos/pull/1121	Patch Third Party Advisory
https://github.com/bareos/bareos/pull/1119	Patch Third Party Advisory
https://github.com/bareos/bareos/pull/1115	Patch Third Party Advisory
https://github.com/bareos/bareos/security/advisories/GHSA-4979-8ffj-4q26	Third Party Advisory
https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/	Exploit Patch Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bareos:bareos::::::::
	cpe:2.3:a:bareos:bareos::::::::
	cpe:2.3:a:bareos:bareos::::::::

Information

Published : 2022-03-15 08:15

Updated : 2022-03-23 20:03

NVD link : CVE-2022-24755

Mitre link : CVE-2022-24755

JSON object : View

CWE

CWE-863

Incorrect Authorization

Advertisement

Products Affected

bareos

bareos

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/bareos/bareos/pull/1121", "name": "https://github.com/bareos/bareos/pull/1121", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/bareos/bareos/pull/1119", "name": "https://github.com/bareos/bareos/pull/1119", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/bareos/bareos/pull/1115", "name": "https://github.com/bareos/bareos/pull/1115", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/bareos/bareos/security/advisories/GHSA-4979-8ffj-4q26", "name": "https://github.com/bareos/bareos/security/advisories/GHSA-4979-8ffj-4q26", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/", "name": "https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/", "tags": ["Exploit", "Patch", "Third Party Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, it will skip authorization checks completely. Expired accounts and accounts with expired passwords can still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-863"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-24755", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2022-03-15T15:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:bareos:bareos:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "19.2.12", "versionStartIncluding": "18.2"}, {"cpe23Uri": "cpe:2.3:a:bareos:bareos:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "20.0.6", "versionStartIncluding": "20.0.0"}, {"cpe23Uri": "cpe:2.3:a:bareos:bareos:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "21.1.0", "versionStartIncluding": "21.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-03-24T03:03Z"}