GHSA-prj9-97mp-mwh2: OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
DescriptionThe `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackingId` and `ot_username`) are injected by OliveTin and overridden, all other `ot_`-prefixed arguments supplied by the user pass through unmodified.These bypassed arguments are:**Not type-checked** — the validation loop only iterates over the action's defined arguments, so `ot_`-prefixed arguments skip all type safety checks entirely.**Set as environment variables** — via `buildEnv()`, with completely unvalidated values, and passed to the executed command.**Included in the template context** — available as `.Arguments.ot_*` in template rendering.Affected Code**Filter bypass — `service/internal/executor/executor.go` (lines 728–731):****System args only override two keys — `service/internal/executor/executor.go` (lines 742–745):**Any other `ot_`-prefixed argument (e.g., `ot_malicious`) survives both functions.**Unvalidated values become environment variables — `service/internal/executor/executor.go` (lines 867–882):**The value `v` is never validated. It can contain newlines, shell metacharacters, null bytes, or any arbitrary data.Proof of ConceptAn attacker sends a `StartAction` request with extra `ot_`-prefixed arguments:These arguments:Pass through `filterToDefinedArgumentsOnly` (the `ot_` prefix exempts them).Are never type-checked (not in the action's argument definitions).Become environment variables `OT_CUSTOM_VAR` and `OT_ANOTHER` in the executed command's environment.Are available in the template rendering context as `.Arguments.ot_custom_var` and `.Arguments.ot_another`.Impact**Environment variable pollution** — attacker can set arbitrary environment variables (with `OT_` uppercased prefix) in the execution environment of any action they can trigger. Scripts or programs that read custom environment variables could be influenced.**Potential for secondary exploitation** — if any executed script or command reads `OT_`-prefixed environment variables, the unvalidated content could cause unexpected behavior.**Template context pollution** — although Go's `text/template` does not recursively evaluate data values (mitigating direct template injection), the extra arguments are accessible in the template context and could interact unexpectedly with custom template logic.Suggested FixRemove the `ot_` prefix exception from `keepArgument`, or restrict it to only the two known system arguments:Discovery MethodologyBoth vulnerabilities were identified through manual source code review of the OliveTin repository, focusing on:Input validation boundaries (API request fields flowing into file system operations and execution contexts)Argument filtering and type-checking logic in the executorFile path construction in the log persistence featureNo automated scanners or fuzzing tools were used. The review was conducted against the current `main` branch source code.
CVSS v3.1: 4.3