{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "Authenticated HTTP GET of Stapler dynamically generated JavaScript followed by crumb-protected Jenkins token-generation POST",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "Docker",
    "Chromium/Playwright",
    "Jenkins 2.579",
    "Stapler",
    "Jetty",
    "Java 21"
  ],
  "target_identity": {
    "repository_url": "https://github.com/jenkinsci/jenkins",
    "commit_sha": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf",
    "target_digest": "a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be",
    "runtime_digest": "a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "repro/proof/browser-same-site-marker.txt",
    "repro/proof/browser-same-site-result.json",
    "repro/proof/browser-same-site-summary.txt",
    "repro/proof/browser-same-site.log",
    "repro/proof/browser-same-site.service.log",
    "repro/proof/fixed_1.dynamic-js.request.txt",
    "repro/proof/fixed_1.dynamic-js.response.body",
    "repro/proof/fixed_1.dynamic-js.response.headers",
    "repro/proof/fixed_1.no_crumb.request.txt",
    "repro/proof/fixed_1.no_crumb.response.body",
    "repro/proof/fixed_1.no_crumb.response.headers",
    "repro/proof/fixed_1.product-component-identity.txt",
    "repro/proof/fixed_1.result.txt",
    "repro/proof/fixed_1.service.log",
    "repro/proof/fixed_2.dynamic-js.request.txt",
    "repro/proof/fixed_2.dynamic-js.response.body",
    "repro/proof/fixed_2.dynamic-js.response.headers",
    "repro/proof/fixed_2.no_crumb.request.txt",
    "repro/proof/fixed_2.no_crumb.response.body",
    "repro/proof/fixed_2.no_crumb.response.headers",
    "repro/proof/fixed_2.product-component-identity.txt",
    "repro/proof/fixed_2.result.txt",
    "repro/proof/fixed_2.service.log",
    "repro/proof/target-identities.txt",
    "repro/proof/vulnerable_1.dynamic-js.request.txt",
    "repro/proof/vulnerable_1.dynamic-js.response.body",
    "repro/proof/vulnerable_1.dynamic-js.response.headers",
    "repro/proof/vulnerable_1.no_crumb.request.txt",
    "repro/proof/vulnerable_1.no_crumb.response.body",
    "repro/proof/vulnerable_1.no_crumb.response.headers",
    "repro/proof/vulnerable_1.product-component-identity.txt",
    "repro/proof/vulnerable_1.result.txt",
    "repro/proof/vulnerable_1.service.log",
    "repro/proof/vulnerable_1.stolen_crumb.request.txt",
    "repro/proof/vulnerable_1.stolen_crumb.response.body",
    "repro/proof/vulnerable_1.stolen_crumb.response.headers",
    "repro/proof/vulnerable_2.dynamic-js.request.txt",
    "repro/proof/vulnerable_2.dynamic-js.response.body",
    "repro/proof/vulnerable_2.dynamic-js.response.headers",
    "repro/proof/vulnerable_2.no_crumb.request.txt",
    "repro/proof/vulnerable_2.no_crumb.response.body",
    "repro/proof/vulnerable_2.no_crumb.response.headers",
    "repro/proof/vulnerable_2.product-component-identity.txt",
    "repro/proof/vulnerable_2.result.txt",
    "repro/proof/vulnerable_2.service.log",
    "repro/proof/vulnerable_2.stolen_crumb.request.txt",
    "repro/proof/vulnerable_2.stolen_crumb.response.body",
    "repro/proof/vulnerable_2.stolen_crumb.response.headers"
  ],
  "artifact_sha256": {
    "repro/proof/browser-same-site-marker.txt": "12d3ac1e20b22bf79ef87c903ef8f8917cebf80ef8f1469418478a1581a724fc",
    "repro/proof/browser-same-site-result.json": "e5cf402e01ff2491228ecc0cd1c5f0e62e526bddd6683c97994fc76a53c27bf7",
    "repro/proof/browser-same-site-summary.txt": "344f896994433f081a361e9d144967c7d873cffd54671b686f98fb92c8a9df1a",
    "repro/proof/browser-same-site.log": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "repro/proof/browser-same-site.service.log": "4cccdffc13270aa32cb6139ee5fbf26417314cd9376a724c5947e8ee28afe4ba",
    "repro/proof/fixed_1.dynamic-js.request.txt": "e9003b429f6bd2c9a98a155cf3c20bca447abcaeaabd3ba527d45ef7e19240e8",
    "repro/proof/fixed_1.dynamic-js.response.body": "cda755409226e6b8d9710a4649a1e6bd8354ec620b09ab765571de67e79b8487",
    "repro/proof/fixed_1.dynamic-js.response.headers": "932ee19d0451462a36ae17d2bf1f4454d1a51fc78571acba5706d0a5c0e940d5",
    "repro/proof/fixed_1.no_crumb.request.txt": "e02c29b3c406a5adb0b585b5b99bc15fc1911e7087ef3095448f2e8baac1a023",
    "repro/proof/fixed_1.no_crumb.response.body": "0387db95dbc10a5f78f12e29d646d9a4e08d6f2c4064195527addd122f041288",
    "repro/proof/fixed_1.no_crumb.response.headers": "bd623b0d8027bc4f056e823e2b3baeac500314e1487f98e18a17f08e3c4898da",
    "repro/proof/fixed_1.product-component-identity.txt": "066b9636a988864148634d68ecc0b666e55b72d2b0ffa0a887468e023e49234a",
    "repro/proof/fixed_1.result.txt": "e98d1fb35dda3009ec3cc4e73648b29d87a33165ec344474a179d3ce24444a43",
    "repro/proof/fixed_1.service.log": "385361eb5bc8eaf0496b60f0ce3ff9a209b2a7cc75ddfc588475018114d353ab",
    "repro/proof/fixed_2.dynamic-js.request.txt": "e9003b429f6bd2c9a98a155cf3c20bca447abcaeaabd3ba527d45ef7e19240e8",
    "repro/proof/fixed_2.dynamic-js.response.body": "cda755409226e6b8d9710a4649a1e6bd8354ec620b09ab765571de67e79b8487",
    "repro/proof/fixed_2.dynamic-js.response.headers": "caffd31a161898197f9a680840a59b7cec805dc337e88ae6b1d13bb5dbc54176",
    "repro/proof/fixed_2.no_crumb.request.txt": "e02c29b3c406a5adb0b585b5b99bc15fc1911e7087ef3095448f2e8baac1a023",
    "repro/proof/fixed_2.no_crumb.response.body": "0387db95dbc10a5f78f12e29d646d9a4e08d6f2c4064195527addd122f041288",
    "repro/proof/fixed_2.no_crumb.response.headers": "8b8a89193a330b32cdb44a0c9a127d68bcf500a4e6c5c904c65933b25adc14ef",
    "repro/proof/fixed_2.product-component-identity.txt": "066b9636a988864148634d68ecc0b666e55b72d2b0ffa0a887468e023e49234a",
    "repro/proof/fixed_2.result.txt": "6417b48d064ca4e817939b556cb52bb1f6ed32578ef166f9c1b99e73fb76a247",
    "repro/proof/fixed_2.service.log": "8b441c92637c333a4e23d0b201f9d91c2aa3fdb459920407ba743ca340db3cdd",
    "repro/proof/target-identities.txt": "a07e828af04987f34b9059b092cf6e0ffd6fbcf0a15c050530449c954f8f5801",
    "repro/proof/vulnerable_1.dynamic-js.request.txt": "e9003b429f6bd2c9a98a155cf3c20bca447abcaeaabd3ba527d45ef7e19240e8",
    "repro/proof/vulnerable_1.dynamic-js.response.body": "4281ec951378c2541ed79ee9c76f629ec3bf677c8542b6312e45df68f45c4b78",
    "repro/proof/vulnerable_1.dynamic-js.response.headers": "90bb3dd0f09a91a835602f6bb0736687a987d1e1ad66aa45485830b4b6178173",
    "repro/proof/vulnerable_1.no_crumb.request.txt": "e02c29b3c406a5adb0b585b5b99bc15fc1911e7087ef3095448f2e8baac1a023",
    "repro/proof/vulnerable_1.no_crumb.response.body": "0387db95dbc10a5f78f12e29d646d9a4e08d6f2c4064195527addd122f041288",
    "repro/proof/vulnerable_1.no_crumb.response.headers": "b9d91f935bf99934df3353f18871707d391235fce3accdc31527d8c5b9eaf2fc",
    "repro/proof/vulnerable_1.product-component-identity.txt": "aacc3beda92d38748166a2b3b10d14d805d8247f57251384740d7e354c3778ba",
    "repro/proof/vulnerable_1.result.txt": "655293fca0c95c2ea3724a1d9ab6671812160ccd0ac5e302c276c1c87bac7361",
    "repro/proof/vulnerable_1.service.log": "d8c218d10436b0a0bcb7b40fd60e6bd8f6865d0317c78e92d9cf172c861538f2",
    "repro/proof/vulnerable_1.stolen_crumb.request.txt": "c7e8f35ad993e2315795de5d65c1b40c04b0369184d7fed2ee393c3dd0e30680",
    "repro/proof/vulnerable_1.stolen_crumb.response.body": "06bf1a210c7943fa9eeb3878afa3b837c275eadf805e0f0c8ff2991c99ff813c",
    "repro/proof/vulnerable_1.stolen_crumb.response.headers": "01e144f8b812e3c14196aa764a02c69eacb17529f8079a6a8e892a3612228f33",
    "repro/proof/vulnerable_2.dynamic-js.request.txt": "e9003b429f6bd2c9a98a155cf3c20bca447abcaeaabd3ba527d45ef7e19240e8",
    "repro/proof/vulnerable_2.dynamic-js.response.body": "75124cd7f24dbf4d59521720d17713d80fc243cb4423deff5eae3d6890d78c9b",
    "repro/proof/vulnerable_2.dynamic-js.response.headers": "fc7fdb9f835000fe0e472490deaefb020eb7a131d428b6464396fa1b9749a692",
    "repro/proof/vulnerable_2.no_crumb.request.txt": "e02c29b3c406a5adb0b585b5b99bc15fc1911e7087ef3095448f2e8baac1a023",
    "repro/proof/vulnerable_2.no_crumb.response.body": "0387db95dbc10a5f78f12e29d646d9a4e08d6f2c4064195527addd122f041288",
    "repro/proof/vulnerable_2.no_crumb.response.headers": "3817a00b5cb61b48c9afbbf984c499cd47fdd55212fdb9a4b64ad32deb0b1161",
    "repro/proof/vulnerable_2.product-component-identity.txt": "aacc3beda92d38748166a2b3b10d14d805d8247f57251384740d7e354c3778ba",
    "repro/proof/vulnerable_2.result.txt": "11e20a80750cfd00cc0bc4ac7ca5a0482f90f5fe6975ffc5ee303101f13c5352",
    "repro/proof/vulnerable_2.service.log": "a86b662cb02052f25c8dbd138128465d6afad712f213a8f0ef632746232dd74c",
    "repro/proof/vulnerable_2.stolen_crumb.request.txt": "74fe6a264362d68f5c83f9ad34c16029c4b098d15360b0b032cea41e8036be02",
    "repro/proof/vulnerable_2.stolen_crumb.response.body": "b172c052cfb46a158c6ead4fd3114268b6448d3e6d69560fc38e99ff7f92068c",
    "repro/proof/vulnerable_2.stolen_crumb.response.headers": "7816bf9b2930797d3a0bedd799d1ea9a1c0851518c865cee270532127b46265c"
  },
  "notes": "A real Chromium victim loaded the dynamic script from a sibling-host same-site attacker page and used its captured literal for a protected POST; two direct vulnerable attempts and two Jenkins 2.580 controls confirmed the divergence."
}