Attack Chain

1. Attacker performs reconnaissance to identify exposed OliveTin API endpoints (default port 1337).
2. Attacker confirms the target is running with default guest permissions (authRequireGuestsToLogin: false).
3. Attacker maps available actions and argument structures via the API.
4. Attacker identifies an action that utilizes an unvalidated argument type in a shell: template.
5. Attacker crafts a payload to escape the shell command argument (e.g., using single quotes and command chaining).
6. Attacker sends an HTTP POST request to StartActionAndWait containing the malicious payload.
7. OliveTin processes the command as the application user (often root), executing the attacker's payload.
8. The output of the command is returned to the attacker in the response log.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary commands with the privileges of the OliveTin process. If OliveTin is running as root, this results in full system compromise.

Recommendation

1. Patch immediately: Upgrade OliveTin to version 3000.11.1 or later.
2. Harden configuration: Set authRequireGuestsToLogin: true in config.yaml and restrict exec permissions for guest and default roles.
3. Principle of Least Privilege: Ensure OliveTin runs under a dedicated, low-privilege service account rather than root.
4. Input Validation: Audit existing action definitions and remove or heavily restrict reliance on shell templates, preferring exec arguments where possible.