Executive brief
OliveTin is a tool that provides a simple web interface for running shell commands. A security flaw was found where unauthenticated users can discover what actions and parameters are configured on the server, even when the system is set to require a login. While this does not allow attackers to run commands directly, it exposes sensitive information about the server's configuration and helps them plan more advanced attacks.
Technical details
The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` fails to implement authentication or authorization checks, specifically missing calls to `auth.UserFromApiCall` or `checkDashboardAccess`. When `AuthRequireGuestsToLogin` is enabled, this endpoint remains reachable to unauthenticated network actors. Because binding IDs are predictable SHA256 hashes of action titles and the endpoint returns different responses for valid vs. invalid arguments, it functions as an oracle. Attackers can use this to enumerate the server's internal action configuration and argument types. This vulnerability was patched in version 3000.13.0.
Affected products
- OliveTin OliveTin < 3000.13.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: patched: Fixed in commit a386570 and release 3000.13.0
- 2026-06-24: advisory