{
  "artifact_sha256": {
    "repro/proof/fixed_1.attacker_session.headers": "4527a2d422ab05ab9ae9610635b042172914fd6f5540d2d1b14658043807c894",
    "repro/proof/fixed_1.health.txt": "8a34f507cb6c9274dd7815da2a43ccd307eb25e36cff71bf103b4093ff8322fc",
    "repro/proof/fixed_1.login.headers": "cc8dd7d5678eee4b78b6284a2c599ee0c96c4e64602c6825c69f7be0c5edbfd3",
    "repro/proof/fixed_1.observation.json": "ac3cd26deab811458dec1d32b8f1b702c9716e0050e28e16e9ba1dc47e050803",
    "repro/proof/fixed_1.remember_auth.headers": "5e44b94f585ee4b1008d8ec2afa0b08f4af409586e6ebf052d03a942d55e9390",
    "repro/proof/fixed_1.replay.body": "8e7f470b239379628cbcd11125aeff6e59b91e0a1ee0b24ac8e0fa05c0f1ab25",
    "repro/proof/fixed_1.replay.headers": "e4b523432017e8afc35c63e15263ef57315105797cdcc5056f4c260a2aa24aaf",
    "repro/proof/fixed_1.service.log": "3ca19fbeb405eca712fecf8ac0acd400944c72dfe8e9b00265d0b6056cc582d3",
    "repro/proof/fixed_2.observation.json": "3435ff3be8c0219fd0017ce124b50098dd7da8fb8b1050277c4fa7cb393810d9",
    "repro/proof/fixed_2.service.log": "717b90220499c625e1188d29de3c7eb60d75a695c08384600fae478e29bb58ef",
    "repro/proof/target_identity.txt": "524a221345a1a6eb57ae2e33f74f05fcf87a10579e8478121a3751ce6425718e",
    "repro/proof/vulnerable_1.attacker_session.headers": "91c4a739ab574b3143abd4fd491ef2e56406336b1ca1f9e9a2c72d8c8687bdf2",
    "repro/proof/vulnerable_1.health.txt": "7700c8715b780e46867a9f3721bfda34a81dd133f3e78fb0948c9b47b5c0aebf",
    "repro/proof/vulnerable_1.login.headers": "c1064b355c571b1b0a12507c2400ac8127f1472f3decfc099d77b8cd01556693",
    "repro/proof/vulnerable_1.observation.json": "43073f7cf4e7b8303457ffa102fdb8135d6f4bbab50b066e28b106ca3b3198be",
    "repro/proof/vulnerable_1.remember_auth.headers": "e3f2abea6d56c337f0a3bc1f41345498dd73066c92f8a1a4a196e59025774f1c",
    "repro/proof/vulnerable_1.replay.body": "27712ebc5b5805641affe01c9d9d65b0092aacd5dc36a696001663015ced3f6e",
    "repro/proof/vulnerable_1.replay.headers": "ed1862c840a5687917d203634f1d697d40f29e6222bbdaa68f5065c6edb31bb6",
    "repro/proof/vulnerable_1.service.log": "bcf6c1ea6b22d4bc49384fdfd238584bf661c3170b7b4d1de52e83da8458b64f",
    "repro/proof/vulnerable_2.observation.json": "9a4b1eaa6ef14911583fce4d056538f338dd29eee09abac08fd6506197877b64",
    "repro/proof/vulnerable_2.service.log": "efe7cebbce00e2cb5f73e74bf8ac85c66355410e56b231b384351ccc45ce8441"
  },
  "entrypoint_detail": "Jenkins /j_spring_security_check plus remember-me authentication and /me/api/json replay over HTTP",
  "entrypoint_kind": "endpoint",
  "healthcheck_passed": true,
  "notes": "Two clean vulnerable Jenkins 2.579 controllers let an independent client replay an attacker-known planted JSESSIONID as victim after remember-me authentication; two Jenkins 2.580 controls rotated/invalidated it.",
  "proof_artifacts": [
    "repro/proof/target_identity.txt",
    "repro/proof/vulnerable_1.health.txt",
    "repro/proof/vulnerable_1.login.headers",
    "repro/proof/vulnerable_1.attacker_session.headers",
    "repro/proof/vulnerable_1.remember_auth.headers",
    "repro/proof/vulnerable_1.replay.headers",
    "repro/proof/vulnerable_1.replay.body",
    "repro/proof/vulnerable_1.observation.json",
    "repro/proof/vulnerable_1.service.log",
    "repro/proof/vulnerable_2.observation.json",
    "repro/proof/vulnerable_2.service.log",
    "repro/proof/fixed_1.health.txt",
    "repro/proof/fixed_1.login.headers",
    "repro/proof/fixed_1.attacker_session.headers",
    "repro/proof/fixed_1.remember_auth.headers",
    "repro/proof/fixed_1.replay.headers",
    "repro/proof/fixed_1.replay.body",
    "repro/proof/fixed_1.observation.json",
    "repro/proof/fixed_1.service.log",
    "repro/proof/fixed_2.observation.json",
    "repro/proof/fixed_2.service.log"
  ],
  "runtime_stack": [
    "Jenkins 2.579",
    "Winstone/Jetty",
    "Spring Security remember-me"
  ],
  "service_started": true,
  "target_identity": {
    "architecture": "x86_64",
    "commit_sha": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf",
    "platform": "linux",
    "repository_url": "https://github.com/jenkinsci/jenkins",
    "runtime_digest": "a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be",
    "target_digest": "a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be"
  },
  "target_path_reached": true
}