{ "entrypoint_kind": "endpoint", "entrypoint_detail": "unauthenticated Tapestry direct-service on /app (Home/ConfigEditor) and pre-auth card/ID web login reaching ExternalUserLookupDb (external card lookup)", "service_started": true, "healthcheck_passed": true, "target_path_reached": true, "runtime_stack": [ "docker", "papercut-ng-app-server", "jetty-12", "apache-derby-embedded" ], "target_identity": { "repository_url": null, "commit_sha": null, "target_digest": null, "platform": "linux", "architecture": "x86_64", "product": "PaperCut NG", "vulnerable_version": "25.0.11 (build 75758), installer sha256 644957717fcb93313e96f8be0e18566a5d49ed0583d0814a7310fe958b5ef17a", "fixed_version": "25.0.12 (build 76497), installer sha256 0782c1d691b485160b498887b0b196bc2a228f51f398b5271b91127c804fc392" }, "proof_artifacts": [ "artifacts/fixed-proof.txt", "artifacts/fixed-render.html", "artifacts/fixed-serverlog-ioc.txt", "artifacts/fixed-version.txt", "artifacts/fixed-wiz1.html", "artifacts/fixed-wiz1.html.headers", "artifacts/fixed-wiz2.html", "artifacts/fixed-wiz2.html.headers", "artifacts/fixed-wiz3.html", "artifacts/fixed-wiz3.html.headers", "artifacts/fixed-wiz4.html", "artifacts/fixed-wiz4.html.headers", "artifacts/fixed-wiz5.html", "artifacts/fixed-wiz5.html.headers", "artifacts/fixed-wiz6.html", "artifacts/fixed-wiz6.html.headers", "artifacts/fixed-wiz7.html", "artifacts/fixed-wiz7.html.headers", "artifacts/vuln-proof.headers", "artifacts/vuln-proof.txt", "artifacts/vuln-render.headers", "artifacts/vuln-render.html", "artifacts/vuln-serverlog-ioc.txt", "artifacts/vuln-version.txt", "artifacts/vuln-wiz1.html", "artifacts/vuln-wiz1.html.headers", "artifacts/vuln-wiz2.html", "artifacts/vuln-wiz2.html.headers", "artifacts/vuln-wiz3.html", "artifacts/vuln-wiz3.html.headers", "artifacts/vuln-wiz4.html", "artifacts/vuln-wiz4.html.headers", "artifacts/vuln-wiz5.html", "artifacts/vuln-wiz5.html.headers", "artifacts/vuln-wiz6.html", "artifacts/vuln-wiz6.html.headers", "artifacts/vuln-wiz7.html", "artifacts/vuln-wiz7.html.headers" ], "artifact_sha256": { "artifacts/fixed-proof.txt": "b67562f77d3a1f7227a931ffc015b1f5d31671e57cce948f43bbe96e12f63833", "artifacts/fixed-render.html": "a9645f90b3002d11b444cbba687d6a51731bb0644d9b937042fa4e7960f9e22e", "artifacts/fixed-serverlog-ioc.txt": "3d9e2d6fe049cbf0b12c5d28c7ec81b25a6c533b9d1722d3e427d189210c39a7", "artifacts/fixed-version.txt": "1ec1cba9a41bdaaaecc2d2256690fe3e1fc830d776ad6f84c509ab6963ca9dbb", "artifacts/fixed-wiz1.html": "b26bda637785008d69544cef97a0c291a701c76b708cce2734b1461e98d81786", "artifacts/fixed-wiz1.html.headers": "4cd62f2ecf495a1d23a817a30376043c35d459fcc221fee12656b1887de4aac5", "artifacts/fixed-wiz2.html": "b5367c835468ffb75aa104550ace35679bf486d61b0c2bda7e81a33f422d046c", "artifacts/fixed-wiz2.html.headers": "4cd62f2ecf495a1d23a817a30376043c35d459fcc221fee12656b1887de4aac5", "artifacts/fixed-wiz3.html": "9bc2269023891536ed4468e3ccf37797816cb2e70c4167af72baf8ee94fa11db", "artifacts/fixed-wiz3.html.headers": "4cd62f2ecf495a1d23a817a30376043c35d459fcc221fee12656b1887de4aac5", "artifacts/fixed-wiz4.html": "00ff801d3a121a8bedd8e87007d477de0624bdc439283e2f8814cd14b869ff32", "artifacts/fixed-wiz4.html.headers": "4cd62f2ecf495a1d23a817a30376043c35d459fcc221fee12656b1887de4aac5", "artifacts/fixed-wiz5.html": "cc0073861fef63bea093b8d8f74d3e6f62c3b274dec9e8498631696be73960d4", "artifacts/fixed-wiz5.html.headers": "4cd62f2ecf495a1d23a817a30376043c35d459fcc221fee12656b1887de4aac5", "artifacts/fixed-wiz6.html": "5690f34761f80728dd1ece69306cddd8a0810b62e55e97e7fe66f6089c3f3018", "artifacts/fixed-wiz6.html.headers": "4cd62f2ecf495a1d23a817a30376043c35d459fcc221fee12656b1887de4aac5", "artifacts/fixed-wiz7.html": "5879020ab65651a4470c9daef73371fd02effa50ce23ed21f584508bb2c93369", "artifacts/fixed-wiz7.html.headers": "7c8b773fc99ece1fe066b9333c5654080dccb421dc398dbb0696be7588453c49", "artifacts/vuln-proof.headers": "4cc19badc138ce504e6eef0867a9a15fe933d84dd5e51a73783eaa107be3a4a3", "artifacts/vuln-proof.txt": "64af24f006a7c208a62dbc612d88295a0e33f19de5e4f627af9b39434ffb3746", "artifacts/vuln-render.headers": "5773e8c25b1648abe11f0a8aa526fb575c71c58277ceea72e533d82577fe0532", "artifacts/vuln-render.html": "3e9000187b5abdcbc53710c50243d4872033d9255b16406db9dcebd61a1daf62", "artifacts/vuln-serverlog-ioc.txt": "1bca4cc7db2347084f45281d7d9422dff28044fa9a04574d4bd979ef71e197a9", "artifacts/vuln-version.txt": "540a2258609564439e729db7866a93bb9f9eb0943e66beb61aaed3df12f39d26", "artifacts/vuln-wiz1.html": "c5527975abf379379c19a32736ff7be05aa79cafb2f0f9d440e77290fc33f7b6", "artifacts/vuln-wiz1.html.headers": "cf82cbbc0395c6a46eb83c6e2db13bf01933bae0144428f7c348a7c31077b1b6", "artifacts/vuln-wiz2.html": "d605d965977f007e52eebf36cafbadeee2f11a2d8a867aae6bd3f909046124ee", "artifacts/vuln-wiz2.html.headers": "cf82cbbc0395c6a46eb83c6e2db13bf01933bae0144428f7c348a7c31077b1b6", "artifacts/vuln-wiz3.html": "5cee8fb7e2ffcc83a45af62dd0dc76395e7b3160ca096b868705331a41acf449", "artifacts/vuln-wiz3.html.headers": "0d49794963bedfe0c9f4c1a0bd09fb8dd2614d38dc1d35ca406687ad3761ccbe", "artifacts/vuln-wiz4.html": "3d752986c5af22c292bc9ebefc495bbcb415dea310a3b2279ba2fea600d9d8e9", "artifacts/vuln-wiz4.html.headers": "0d49794963bedfe0c9f4c1a0bd09fb8dd2614d38dc1d35ca406687ad3761ccbe", "artifacts/vuln-wiz5.html": "92c219cae29829bc27c3f364dbef5fb4ebf1d5d950f46556e5368cd74bb217cf", "artifacts/vuln-wiz5.html.headers": "0d49794963bedfe0c9f4c1a0bd09fb8dd2614d38dc1d35ca406687ad3761ccbe", "artifacts/vuln-wiz6.html": "b6af3efc66c060acc8ba563801d4edc090fb2978150700f3159b42fec89e38a4", "artifacts/vuln-wiz6.html.headers": "0d49794963bedfe0c9f4c1a0bd09fb8dd2614d38dc1d35ca406687ad3761ccbe", "artifacts/vuln-wiz7.html": "a4edea5964c35c3f7a0fb52b31580218004217a9737f0278c9ac5a3fc30c3a5a", "artifacts/vuln-wiz7.html.headers": "5fb4ed06d6d620b9211133241ed3d242b5646d849452627990f9d5969c8cfa64" }, "vulnerable_rce_confirmed": true, "fixed_chain_blocked": true, "notes": "Unauthenticated Tapestry-3 complex direct-service config write -> external card-lookup Derby CALL file write -> planted Tapestry page OGNL eval -> OS command as papercut; receipt fetched over HTTP. 25.0.12 blocks config write (BasePaperCutPage service-path rights) and SQL CALL (ExternalUserLookupDb filter)." }