OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses.
As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.
Attack Parameters
Attack Vector
Network
Атака возможна удалённо
Attack Complexity
Low
Легко эксплуатировать
Privileges Required
Low
Нужны базовые права
User Interaction
None
Не нужно действие пользователя
Impact Assessment
Confidentiality
High
Полная утечка данных
Integrity
None
Нет модификации данных
Availability
None
Нет нарушения работы
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be…
security-advisories@github.com
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
security-advisories@github.com
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg
security-advisories@github.com