{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/olivetin--3000.11.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-30225"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OliveTin (\u003c 3000.11.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OliveTin"],"content_html":"\u003cp\u003eOliveTin versions below 3000.11.1 contain multiple vulnerabilities that facilitate unauthenticated remote code execution (RCE). The primary vectors involve insecure default configurations where guest users are granted \u003ccode\u003eexec\u003c/code\u003e permissions, combined with a lack of input validation in argument types (e.g., \u003ccode\u003epassword\u003c/code\u003e, \u003ccode\u003eraw_string_multiline\u003c/code\u003e). These arguments are interpolated directly into shell templates, allowing for shell injection. Additionally, CVE-2026-30225 identifies an ACL bypass in the \u003ccode\u003eRestartAction\u003c/code\u003e function, where the application fails to maintain the authenticated context, causing actions to be re-executed with guest privileges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify exposed OliveTin API endpoints (default port 1337).\u003c/li\u003e\n\u003cli\u003eAttacker confirms the target is running with default guest permissions (\u003ccode\u003eauthRequireGuestsToLogin: false\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker maps available actions and argument structures via the API.\u003c/li\u003e\n\u003cli\u003eAttacker identifies an action that utilizes an unvalidated argument type in a \u003ccode\u003eshell:\u003c/code\u003e template.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a payload to escape the shell command argument (e.g., using single quotes and command chaining).\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request to \u003ccode\u003eStartActionAndWait\u003c/code\u003e containing the malicious payload.\u003c/li\u003e\n\u003cli\u003eOliveTin processes the command as the application user (often \u003ccode\u003eroot\u003c/code\u003e), executing the attacker's payload.\u003c/li\u003e\n\u003cli\u003eThe output of the command is returned to the attacker in the response log.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary commands with the privileges of the OliveTin process. If OliveTin is running as \u003ccode\u003eroot\u003c/code\u003e, this results in full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately: Upgrade OliveTin to version 3000.11.1 or later.\u003c/li\u003e\n\u003cli\u003eHarden configuration: Set \u003ccode\u003eauthRequireGuestsToLogin: true\u003c/code\u003e in \u003ccode\u003econfig.yaml\u003c/code\u003e and restrict \u003ccode\u003eexec\u003c/code\u003e permissions for guest and default roles.\u003c/li\u003e\n\u003cli\u003ePrinciple of Least Privilege: Ensure OliveTin runs under a dedicated, low-privilege service account rather than \u003ccode\u003eroot\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eInput Validation: Audit existing action definitions and remove or heavily restrict reliance on \u003ccode\u003eshell\u003c/code\u003e templates, preferring \u003ccode\u003eexec\u003c/code\u003e arguments where possible.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T03:49:38Z","date_published":"2026-10-29T03:49:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-olivetin-rce/","summary":"OliveTin versions prior to 3000.11.1 are vulnerable to unauthenticated remote code execution via insecure guest configurations and lack of input validation for action arguments.","title":"OliveTin: Unauthenticated Remote Code Execution (CVE-2026-30225)","url":"https://feed.craftedsignal.io/briefs/2026-10-olivetin-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - OliveTin (\u003c 3000.11.1)","version":"https://jsonfeed.org/version/1.1"}