【中危】OliveTin 安全更新（GHSA-prj9-97mp-mwh2）

安全情报快照 · 风险级别：中危 · CVSS：4.3 · CVE-2026-53541 · GHSA-prj9-97mp-mwh2

先看结论

OliveTin存在安全风险，< 0.0.0-20260531214440-ebffd9f040f7 受影响，建议升级至 0.0.0-20260531214440-ebffd9f040f7。

影响范围

生态	组件	受影响版本	首个修复版本
go	`github.com/OliveTin/OliveTin`	< 0.0.0-20260531214440-ebffd9f040f7	0.0.0-20260531214440-ebffd9f040f7

处置建议

优先将 github.com/OliveTin/OliveTin 升级至 0.0.0-20260531214440-ebffd9f040f7 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Description

The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, a special case allows any argument whose name starts with ot_ to bypass this filter. While two system arguments (ot_executionTrackingId and ot_username) are injected by OliveTin and overridden, all other ot_-prefixed arguments supplied by the user pass through unmodified.

These bypassed arguments are:

Not type-checked — the validation loop only iterates over the action's defined arguments, so ot_-prefixed arguments skip all type safety checks entirely.
Set as environment variables — via buildEnv(), with completely unvalidated values, and passed to the executed command.
Included in the template context — available as .Arguments.ot_* in template rendering.

Affected Code

Filter bypass — service/internal/executor/executor.go (lines 728–731):

func keepArgument(name string, definedNames map[string]struct{}) bool {
    _, ok := definedNames[name]
    return ok || strings.HasPrefix(name, "ot_")
}

System args only override two keys — service/internal/executor/executor.go (lines 742–745):

func injectSystemArgs(req *ExecutionRequest) {
    req.Arguments["ot_executionTrackingId"] = req.TrackingID
    req.Arguments["ot_username"] = req.AuthenticatedUser.Username
}

Any other ot_-prefixed argument (e.g., ot_malicious) survives both functions.

Unvalidated values become environment variables — service/internal/executor/executor.go (lines 867–882):

func buildEnv(args map[string]string) []string {
    ret := append(os.Environ(), "OLIVETIN=1")
    for k, v := range args {
        varName := fmt.Sprintf("%v", strings.TrimSpace(strings.ToUpper(k)))
        if varName == "" { continue }
        ret = append(ret, fmt.Sprintf("%v=%v", varName, v))
    }
    return ret
}

The value v is never validated. It can contain newlines, shell metacharacters, null bytes, or any arbitrary data.

Proof of Concept

An attacker sends a StartAction request with extra ot_-prefixed arguments:

{
  "bindingId": "<any-action-id>",
  "arguments": [
    { "name": "ot_custom_var", "value": "arbitrary unvalidated content \n with newlines" },
    { "name": "ot_another",    "value": "$(whoami)" }
  ]
}

These arguments:

Pass through filterToDefinedArgumentsOnly (the ot_ prefix exempts them).
Are never type-checked (not in the action's argument definitions).
Become environment variables OT_CUSTOM_VAR and OT_ANOTHER in the executed command's environment.
Are available in the template rendering context as .Arguments.ot_custom_var and .Arguments.ot_another.

Impact

Environment variable pollution — attacker can set arbitrary environment variables (with OT_ uppercased prefix) in the execution environment of any action they can trigger. Scripts or programs that read custom environment variables could be influenced.
Potential for secondary exploitation — if any executed script or command reads OT_-prefixed environment variables, the unvalidated content could cause unexpected behavior.
Template context pollution — although Go's text/template does not recursively evaluate data values (mitigating direct template injection), the extra arguments are accessible in the template context and could interact unexpectedly with custom template logic.

Suggested Fix

Remove the ot_ prefix exception from keepArgument, or restrict it to only the two known system arguments:

var systemArgs = map[string]struct{}{
    "ot_executionTrackingId": {},
    "ot_username":            {},
}

func keepArgument(name string, definedNames map[string]struct{}) bool {
    _, isDefined := definedNames[name]
    _, isSystem := systemArgs[name]
    return isDefined || isSystem
}

Discovery Methodology

Both vulnerabilities were identified through manual source code review of the OliveTin repository, focusing on:

Input validation boundaries (API request fields flowing into file system operations and execution contexts)
Argument filtering and type-checking logic in the executor
File path construction in the log persistence feature

No automated scanners or fuzzing tools were used. The review was conducted against the current main branch source code.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。