OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream

Summary

OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.

Details

The issue is in the live event streaming path.

EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:

• service/internal/api/api.go:776

After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:

• service/internal/api/api.go:846 OnExecutionStarted
• service/internal/api/api.go:869 OnExecutionFinished
• service/internal/api/api.go:1047 OnOutputChunk

The event payload includes action output through:

• service/internal/api/api.go:295 internalLogEntryToPb
• service/internal/api/api.go:302 Output

By contrast, the normal log APIs do apply per-action authorization checks:

• service/internal/api/api.go:518 GetLogs
• service/internal/api/api.go:585 GetActionLogs
• service/internal/api/api.go:544 isLogEntryAllowed

Root cause:

• the subscription path enforces only coarse dashboard access
• execution callbacks broadcast to every connected client
• no per-recipient ACL check is applied before sending action metadata or output

I validated the issue using:

• an admin user with full ACLs
• an alice user with no ACLs
• a protected action that outputs TOPSECRET=alpha-bravo-charlie

Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.

PoC

Tested version:

  - 3000.10.2

1. Fetch and check out 3000.10.2 in a clean worktree:

  git -C OliveTin fetch origin tag 3000.10.2
  git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2

2. Copy the PoC test into the clean tree:

  cp OliveTin/service/internal/api/event_stream_leak_test.go \
    OliveTin-3000.10.2/service/internal/api/