Описание
OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login
Summary
OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions.
Details
The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs.
KillAction() authenticates the caller and applies only the per-action kill ACL check:
- service/internal/api/api.go:62
However, it does not enforce the guest login requirement. The guest/login gate exists separately in:
- service/internal/api/api.go:474
That gate is used by dashboard-style methods, but not by KillAction.
In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged:
- service/internal/config/sanitize.go:160
Specifically:
- DefaultPermissions.View = false
- DefaultPermissions.Exec = false
- DefaultPermissions.Logs = false
- DefaultPermissions.Kill remains unchanged
As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill():
- service/internal/acl/acl.go:133
I validated this behavior on a clean 3000.10.2 setup:
- guests were denied access to GetDashboard
- an authenticated admin user started a long-running action
- an unauthenticated guest successfully called KillAction
- the action was terminated
This confirms a real authorization bypass affecting action termination.
PoC
Tested version:
- Create a minimal config:
- Start OliveTin 3000.10.2:
- Confirm the server is ready:
- Prove guests are blocked from dashboard access:
- Log in as admin:
- Start a long-running action as admin:
- Kill it as an unauthenticated guest:
Observed response:
- Confirm in container logs:
Observed relevant lines:
This proves:
- guests are denied dashboard access
- guests can still invoke KillAction
- the running action is successfully terminated by an unauthenticated user
Impact
This is an unauthenticated broken access control vulnerability resulting in denial of service.
An unauthenticated guest can:
- terminate active jobs started by legitimate users
- disrupt long-running administrative or operational workflows
- interfere with privileged actions without being allowed to log in
Who is impacted:
- OliveTin deployments with authRequireGuestsToLogin: true
- multi-user environments where actions may run for meaningful durations
- operational environments where stopping a running action can interrupt maintenance, deployment, backup, or service-control tasks
This issue does not require valid credentials, only knowledge of a live executionTrackingId. That still makes it a real and exploitable availability issue in environments where execution identifiers can be observed or predicted through adjacent leaks or shared operator knowledge.
Пакеты
github.com/OliveTin/OliveTin
< 0.0.0-20260302002902-d9804182eae4
0.0.0-20260302002902-d9804182eae4
Связанные уязвимости
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.