A broken access control vulnerability in OliveTin allows unauthenticated attackers to perform unauthorized denial of service attacks by terminating active processes.

This is an improper access control issue where the KillAction RPC function fails to verify user authentication. Even when the configuration requires guests to log in, an unauthenticated attacker can invoke this function to stop legitimate system actions.

Successful exploitation results in a denial of service, as an attacker can arbitrarily terminate critical shell commands managed by the OliveTin dashboard. While the CVSS score of 7.5 indicates a high risk, the primary impact is operational disruption, which can halt automated workflows and impact service availability for legitimate users.

Immediate Action: Update OliveTin to version 3000.11.0 or later to include the necessary authorization checks for the KillAction RPC.

Proactive Monitoring: Review web access logs for frequent or unauthorized calls to the KillAction endpoint, particularly from IP addresses not associated with authorized administrative users.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the OliveTin dashboard to trusted IP ranges or VPN-only access until the update can be applied.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for operational disruption, organizations should prioritize the update to version 3000.11.0. If immediate patching is not feasible, ensure that the OliveTin instance is not exposed to the public internet and limit access to trusted internal networks to mitigate the risk of unauthorized command termination.