{
  "entrypoint_kind": "tcp_peer",
  "entrypoint_detail": "Real Wazuh MasterHandler cluster TCP listener (default TCP/1516 when available) accepts a Fernet-encrypted malicious worker peer; master DistributedAPI.forward_request sends b'dapi'; worker returns crafted AffectedItemsWazuhResult through original new_str/str_upd/dapi_res; dapi.py json.loads(..., object_hook=as_wazuh_object) and reduce(or_, response) reach results.py sort_casting merge.",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "wazuh-manager cluster MasterHandler TCP server",
    "wazuh.core.cluster.common.Handler Fernet frame protocol",
    "wazuh.core.cluster.dapi.DistributedAPI.forward_request",
    "wazuh.core.results.AffectedItemsWazuhResult.merge",
    "python3"
  ],
  "target_identity": {
    "repository_url": "https://github.com/wazuh/wazuh.git",
    "commit_sha": "24609e140155d7fd2bddd4ebb045dbde5bea320f",
    "fixed_commit_sha": "b29849f8abb08d78f257e6106b6111a8a1b0e621",
    "target_digest": "d160cf3d8eac1e4b48797b2cb524b1be132cdfada8c6befc02dde7499d7bc843",
    "fixed_target_digest": "8c1fce034a2ce542badf1b67e3564f815c8da9b1ff43f29d4d1f3addedd698a2",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/product_patch_check.log",
    "logs/product_vuln_1.log",
    "logs/product_vuln_2.log",
    "logs/product_fixed_1.log",
    "logs/product_fixed_2.log",
    "repro/evil_worker_response.json",
    "repro/observations/product_vuln_1.json",
    "repro/observations/product_vuln_2.json",
    "repro/observations/product_fixed_1.json",
    "repro/observations/product_fixed_2.json",
    "repro/markers/product_marker_vuln_1.txt",
    "repro/markers/product_marker_vuln_2.txt"
  ],
  "artifact_sha256": {
    "logs/product_patch_check.log": "8fc165452dc0fb7f7e1c34fadc45d9bc7842597809e3f11b86524f02fcb11239",
    "logs/product_vuln_1.log": "7fbf6e2aa933ad2f7e595f7fb4193b9ce6c34fb19ebc13a61131fe74380ee764",
    "logs/product_vuln_2.log": "f5ffb22e36437993662bb63f524ec1fd907978f5d9bfacfa864154140b91c49b",
    "logs/product_fixed_1.log": "4f7a7bd52e2d183acda5b5d128c57aa5ef973ebbcc8d276796b106eb19d547bc",
    "logs/product_fixed_2.log": "377c1ae51192ae143f0510038f8a30157c7e44e80cf2223c2e6077af63168a2e",
    "repro/evil_worker_response.json": "0263321204e3329170522648eac55056273dec224ae934ecf7ceb0e64f3c52b6",
    "repro/observations/product_vuln_1.json": "92a1b7e9c2d48c77ade88ab435e4f63cc3554facfde7341f6cf6bca9c9b5f39c",
    "repro/observations/product_vuln_2.json": "e02d92ea62acf1d4c90f62a7e126f949560cd21b47b7ad80d4f9d329208532a2",
    "repro/observations/product_fixed_1.json": "b0ba007d7d822a1026e003e990d71878201d86aef26cb262381450c6891f541a",
    "repro/observations/product_fixed_2.json": "bf593d38abd5f7dbbb1e69ec01d1d85ad552bc18eec537391a703e9dee298b70",
    "repro/markers/product_marker_vuln_1.txt": "31a1c5039cec0229244dedacca13fa0c593d04b4620ef3c3a3c81aec20d5c887",
    "repro/markers/product_marker_vuln_2.txt": "8aee9ba32a5c4f841063e160b7c8f5ea8dd013fbadff4d3dcce97b4c4ae03f21"
  },
  "notes": "vulnerable attempts 2/2 wrote unique command markers through the Wazuh TCP/Fernet DAPI path; fixed attempts 2/2 rejected sort_casting='exec' before marker creation"
}