{
  "entrypoint_detail": "real Horilla /media/<path> HTTP route",
  "entrypoint_kind": "endpoint",
  "healthcheck_passed": true,
  "notes": "Confirmed: vulnerable Horilla 1.5.0 returns exact private media body only when an unauthenticated attacker adds Referer http://attacker.invalid/login; fixed Horilla 1.6.0 denies the same request.",
  "proof_artifacts": [
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/cache_context_resolved.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/protected_media_hunks.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/vuln_worktree_head.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/fixed_worktree_head.txt",
    "logs/pip_install_vuln_f86e9625862fa828_20260722T055646Z-13223.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/deps/vuln_f86e9625862fa828_pip_freeze.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/vuln_source_identity.json",
    "logs/pip_install_fixed_7fb44184827cf327_20260722T055646Z-13223.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/deps/fixed_7fb44184827cf327_pip_freeze.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/fixed_source_identity.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/vuln/prepare_runtime.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/vuln/modified_file_inventory_after_prepare.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/fixed/prepare_runtime.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/fixed/modified_file_inventory_after_prepare.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/private_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/attempt_setup.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/container_id.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/container_inspect.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/health_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/health_response_body.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/server_startup.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/server_final.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/modified_file_inventory_after_startup.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/attempt_result.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/private_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/attempt_setup.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/container_id.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/container_inspect.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/health_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/health_response_body.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/server_startup.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/server_final.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/modified_file_inventory_after_startup.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/attempt_result.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/private_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/attempt_setup.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/container_id.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/container_inspect.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/health_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/health_response_body.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/server_startup.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/server_final.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/modified_file_inventory_after_startup.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/attempt_result.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/private_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_canary.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/attempt_setup.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/container_id.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/container_inspect.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/health_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/health_response_body.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/server_startup.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_request.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_response_headers.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_response_body.bin",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_curl_trace.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_curl_stderr.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_meta.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/server_final.log",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/modified_file_inventory_after_startup.txt",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/attempt_result.json",
    "artifacts/horilla_referer_bypass/20260722T055646Z-13223/matrix_summary.json"
  ],
  "runtime_stack": [
    "Docker",
    "python:3.10-slim-bullseye",
    "Horilla Django runserver",
    "SQLite"
  ],
  "service_started": true,
  "target_path_reached": true
}