OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

Vulnerability

Overview

OliveTin, a web interface for executing predefined shell commands, contains a broken access control vulnerability in versions prior to 3000.11.0. The issue arises because the KillAction RPC endpoint does not enforce the authRequireGuestsToLogin setting. While guests are correctly blocked from accessing the dashboard, they can still directly call the KillAction RPC and successfully terminate running actions. This inconsistency in authorization enforcement allows unauthenticated guests to initiate a denial-of-service condition against legitimate action executions [1][2].

Exploitation and

Attack Surface

An unauthenticated guest can exploit this vulnerability by directly invoking the KillAction remote procedure call. The lack of guest login enforcement on this specific endpoint, combined with the fact that config sanitization leaves the kill permission unchanged when guest login is required, means that in the default path, a guest user can satisfy the IsAllowedKill() check. The exploit requires no authentication and can be performed over the network. A proof-of-concept demonstrates that on a clean installation, a guest can kill an action started by an authenticated admin user [2].

Impact

Successful exploitation allows an unauthenticated attacker to terminate any running action, resulting in unauthorized denial of service. This can disrupt legitimate workflows and system administration tasks that rely on OliveTin, potentially causing service interruptions or data loss if the terminated actions are critical operations. The vulnerability does not grant the attacker any access to read data or execute new actions, limited strictly to killing already-running processes [1][2].

Mitigation

The vulnerability has been patched in OliveTin version 3000.11.0 [1][3]. Users running earlier versions should upgrade immediately to close this authorization bypass. No workarounds are mentioned in the advisory other than applying the patch, which ensures that KillAction properly enforces the guest login requirement [2].