{
  "artifact_sha256": {
    "repro/proof-20260924T032301Z-28737/awx-image-digest.txt": "b858d8bd95b50bef0caa203ddf1ba6a223fb7014e5d5ff729392283257b97355",
    "repro/proof-20260924T032301Z-28737/controller-inspect.json": "fff47f21a9a4407cabecb947aa188a9434b9462c5996449ef6d0b305cc85dc7d",
    "repro/proof-20260924T032301Z-28737/ee-image-digest.txt": "ec8141d127a4cbc9f2124d1da28e242c568180758379929fea9f9848b79db864",
    "repro/proof-20260924T032301Z-28737/fixed-1-create-request.json": "add2a399d0eea2ca4267b8c0a00adf1e57bf2d8200c61f5d17d9882562d0564f",
    "repro/proof-20260924T032301Z-28737/fixed-1-create-response.json": "67f0f998d48dcf4d26e8327675bdcc5f7458fd1165ff473b4cde1663705a0cd3",
    "repro/proof-20260924T032301Z-28737/fixed-1-create-status.txt": "e4df891c484d7abb985dadf539fa1883a646dab6337af5cae4159c587b7050cc",
    "repro/proof-20260924T032301Z-28737/fixed-1-marker-name.txt": "a5488b73c88bc4ba81455e0ea2dbcfe6f0f5fb4afca706e513718ac451833ec9",
    "repro/proof-20260924T032301Z-28737/fixed-1-marker-negative-control.txt": "7925d3e9a9613a093e5eb4054b32aa39de910d2b03ba7e8046c3b4550b8de1e4",
    "repro/proof-20260924T032301Z-28737/fixed-2-create-request.json": "dfa8ea78708701904d4705872c3d92158941dfac8d9ce7e2ae4c19a342939a38",
    "repro/proof-20260924T032301Z-28737/fixed-2-create-response.json": "67f0f998d48dcf4d26e8327675bdcc5f7458fd1165ff473b4cde1663705a0cd3",
    "repro/proof-20260924T032301Z-28737/fixed-2-create-status.txt": "e4df891c484d7abb985dadf539fa1883a646dab6337af5cae4159c587b7050cc",
    "repro/proof-20260924T032301Z-28737/fixed-2-marker-name.txt": "119c7b5547d7f236ac6ed353fac725975ed75a1ce431d19c68db0775a7dd90f4",
    "repro/proof-20260924T032301Z-28737/fixed-2-marker-negative-control.txt": "7925d3e9a9613a093e5eb4054b32aa39de910d2b03ba7e8046c3b4550b8de1e4",
    "repro/proof-20260924T032301Z-28737/healthcheck-request.txt": "4e5b902cb616bd2fa1af0ea13b7e18bb42b0a87ba07f758fe254faf3b941ce89",
    "repro/proof-20260924T032301Z-28737/healthcheck-response.json": "8d74817c49e20cb003e9939650a7498ecd9f232f5349e8cda9bedb588c808006",
    "repro/proof-20260924T032301Z-28737/runtime-configuration.txt": "f919fc84f951d47ca66cfb9f3087915c0a83ebe89d18cafe1052ba96df4909e2",
    "repro/proof-20260924T032301Z-28737/service-start-command.txt": "51a6b12dc374cd50e646d74ffaff10be09ec3eeb11699af362e22ceee587eb55",
    "repro/proof-20260924T032301Z-28737/target-commit.txt": "7dd12e29ae11610b0783a005c017c0e76f2c95719d6f54a630aa95e8111c18fa",
    "repro/proof-20260924T032301Z-28737/target-digest.txt": "c8372bc54bfb19ebfbd0542ccdd8d19bf1dc84718fcf7abf66bf1fa925e618cd",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-create-request.json": "e3a45e482bd6f4cb03b8a0ad15747aeb81e3f01b4bb2c72f26975a2dddc4f009",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-create-response.json": "c84895429bfd2aa7470cf322242ebfddda5e97b6926811fb2a5e3136277910ae",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-create-status.txt": "14993db977ff54ff86b0c447cbf330d1718c108468ea0f0fe2ec1fbfdb73af2b",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-marker-name.txt": "c3f67f9badfd6c3a549f01e475077dc762bd36907d5174d769bc9378cac0d0bb",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-marker.txt": "53175bcc0524f37b47062fafdda28e3f8eb91d519ca0a184ca71bbebe72f969a",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-stdout.txt": "4f9fbddc938adbcf7f26322342a9192e35da062d29c611a0fb3ab0ae9f6a326b",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-detail.json": "3ed7c3240039070647f4c5ba32b94657c82127bb26cd3460705108df437655c7",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-request.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-response.json": "cb7f8565131c3202d245ba027099f0168cc938aa8caed887f6e388686ffa66a3",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-status.txt": "1a55a7d16b47deb40890edb52c2234c4adddf330dbac2e1f1eedf0a9723a4c70",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-create-request.json": "5a8ba0ed237521c23ad9a6cd34828beb14b403a0c9bea190a7158ae78f3925f5",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-create-response.json": "2c2106a5884d7b533ed52b90d3e4c8c4c82debc0be39d9b819341fee432854d2",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-create-status.txt": "14993db977ff54ff86b0c447cbf330d1718c108468ea0f0fe2ec1fbfdb73af2b",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-marker-name.txt": "0f12d27c0cb12609ad3d6895761c3d13ae16ad03037b523c4df224f488240ff5",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-marker.txt": "eca865251639e296af199c7b6f0f487bfd08ebd259f17ab85514bd5c13153df0",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-stdout.txt": "3b9fd57d98b16a107d58b7f13b2bd101e465484ecfddd65944eb0ba11966009c",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-detail.json": "a658b00f0443ca0d35f171c63743372919c66d07f6f42a3b1f30ff6e48e78b8f",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-request.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-response.json": "a7295b7482c50a91b380e6ed1794ab4c3e8d94107b10f6edae666d0308bab59f",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-status.txt": "1a55a7d16b47deb40890edb52c2234c4adddf330dbac2e1f1eedf0a9723a4c70"
  },
  "entrypoint_detail": "Authenticated AWX API POST /api/v2/projects/ followed by POST /api/v2/projects/<id>/update/",
  "entrypoint_kind": "endpoint",
  "healthcheck_passed": true,
  "notes": "Two vulnerable real API/ProjectUpdate attempts executed attacker-selected commands and produced unique target-local command-output markers; two fixed API controls returned HTTP 400 and produced no marker. The oversized full controller diagnostic is retained outside the promoted proof closure; compact API, task stdout, marker, control, and identity artifacts establish the finding.",
  "proof_artifacts": [
    "repro/proof-20260924T032301Z-28737/target-commit.txt",
    "repro/proof-20260924T032301Z-28737/target-digest.txt",
    "repro/proof-20260924T032301Z-28737/healthcheck-request.txt",
    "repro/proof-20260924T032301Z-28737/healthcheck-response.json",
    "repro/proof-20260924T032301Z-28737/service-start-command.txt",
    "repro/proof-20260924T032301Z-28737/controller-inspect.json",
    "repro/proof-20260924T032301Z-28737/runtime-configuration.txt",
    "repro/proof-20260924T032301Z-28737/awx-image-digest.txt",
    "repro/proof-20260924T032301Z-28737/ee-image-digest.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-create-request.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-create-response.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-create-status.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-marker-name.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-request.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-response.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-status.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-update-detail.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-stdout.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-1-marker.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-create-request.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-create-response.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-create-status.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-marker-name.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-request.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-response.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-status.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-update-detail.json",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-stdout.txt",
    "repro/proof-20260924T032301Z-28737/vulnerable-2-marker.txt",
    "repro/proof-20260924T032301Z-28737/fixed-1-create-request.json",
    "repro/proof-20260924T032301Z-28737/fixed-1-create-response.json",
    "repro/proof-20260924T032301Z-28737/fixed-1-create-status.txt",
    "repro/proof-20260924T032301Z-28737/fixed-1-marker-name.txt",
    "repro/proof-20260924T032301Z-28737/fixed-1-marker-negative-control.txt",
    "repro/proof-20260924T032301Z-28737/fixed-2-create-request.json",
    "repro/proof-20260924T032301Z-28737/fixed-2-create-response.json",
    "repro/proof-20260924T032301Z-28737/fixed-2-create-status.txt",
    "repro/proof-20260924T032301Z-28737/fixed-2-marker-name.txt",
    "repro/proof-20260924T032301Z-28737/fixed-2-marker-negative-control.txt"
  ],
  "runtime_stack": [
    "awx-automation-controller",
    "postgresql",
    "redis",
    "receptor",
    "podman",
    "ansible-runner",
    "git"
  ],
  "service_started": true,
  "target_identity": {
    "architecture": "x86_64",
    "commit_sha": "a5b2179a3e693dd8e9f4c186636d93f9a436ada4",
    "platform": "linux",
    "repository_url": "https://github.com/ansible/awx.git",
    "runtime_digest": "sha256:8c60a538d41d40e1b72e29adf6fe946f9770dad02e102bf13dab5589fb8be1e4",
    "target_digest": "f7e90f88bb24a6a6628a9fa39e1187fd6873d6050810edd7b3db790d83b8b203"
  },
  "target_path_reached": true
}