{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "authenticated Item/Configure POST /job/carrier/config.xml populates transient SCMTrigger.BuildAction.run, Run.project, AbstractItem.parent, and name; forged Stapler route reaches Jenkins scriptText",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "Jenkins 2.579 (vulnerable)",
    "Jenkins 2.580 (fixed negative control)",
    "matrix-auth 3.2.8"
  ],
  "target_identity": {
    "repository_url": "https://github.com/jenkinsci/jenkins",
    "commit_sha": "9095ea3a5c5e7dcd392695a5dd880af1c9910ddf",
    "target_digest": "a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be",
    "runtime_digest": "a7342867ea33efaacf825229d50b7fc77c144ecada9719ab4e32419f5d7412be",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "negative_control_identity": {
    "repository_url": "https://github.com/jenkinsci/jenkins",
    "commit_sha": "497de4961ad80d97e26bfdeb0d2e40442a84ecb0",
    "target_digest": "0e50a5b11ac14f3b84e529d725ed3a1c4b17ba16188dfa8d9a0189428b0839b1",
    "runtime_digest": "0e50a5b11ac14f3b84e529d725ed3a1c4b17ba16188dfa8d9a0189428b0839b1"
  },
  "proof_artifacts": [
    "repro/proof/vulnerable_1.service.log",
    "repro/proof/vulnerable_1.config.request.xml",
    "repro/proof/vulnerable_1.config.response.headers",
    "repro/proof/vulnerable_1.route.request.txt",
    "repro/proof/vulnerable_1.route.response.headers",
    "repro/proof/vulnerable_1.route.response.body",
    "repro/proof/vulnerable_1.marker.txt",
    "repro/proof/vulnerable_1.observation.json",
    "repro/proof/vulnerable_1.rename.response.headers",
    "repro/proof/vulnerable_1.target.response.json",
    "repro/proof/vulnerable_1.owned.response.json",
    "repro/proof/vulnerable_1.result.txt",
    "repro/proof/vulnerable_2.service.log",
    "repro/proof/vulnerable_2.config.request.xml",
    "repro/proof/vulnerable_2.config.response.headers",
    "repro/proof/vulnerable_2.route.request.txt",
    "repro/proof/vulnerable_2.route.response.headers",
    "repro/proof/vulnerable_2.route.response.body",
    "repro/proof/vulnerable_2.marker.txt",
    "repro/proof/vulnerable_2.observation.json",
    "repro/proof/vulnerable_2.rename.response.headers",
    "repro/proof/vulnerable_2.target.response.json",
    "repro/proof/vulnerable_2.owned.response.json",
    "repro/proof/vulnerable_2.result.txt",
    "repro/proof/fixed_1.service.log",
    "repro/proof/fixed_1.config.request.xml",
    "repro/proof/fixed_1.config.response.headers",
    "repro/proof/fixed_1.route.request.txt",
    "repro/proof/fixed_1.route.response.headers",
    "repro/proof/fixed_1.route.response.body",
    "repro/proof/fixed_1.marker.txt",
    "repro/proof/fixed_1.observation.json",
    "repro/proof/fixed_1.rename.response.headers",
    "repro/proof/fixed_1.target.response.json",
    "repro/proof/fixed_1.owned.response.json",
    "repro/proof/fixed_1.result.txt",
    "repro/proof/fixed_2.service.log",
    "repro/proof/fixed_2.config.request.xml",
    "repro/proof/fixed_2.config.response.headers",
    "repro/proof/fixed_2.route.request.txt",
    "repro/proof/fixed_2.route.response.headers",
    "repro/proof/fixed_2.route.response.body",
    "repro/proof/fixed_2.marker.txt",
    "repro/proof/fixed_2.observation.json",
    "repro/proof/fixed_2.rename.response.headers",
    "repro/proof/fixed_2.target.response.json",
    "repro/proof/fixed_2.owned.response.json",
    "repro/proof/fixed_2.result.txt"
  ],
  "artifact_sha256": {
    "repro/proof/vulnerable_1.service.log": "c4dd7ee7b44a6a3eb0c8c71152f16faf6a88980827d4a36cb10be92bc2564c4f",
    "repro/proof/vulnerable_1.config.request.xml": "c98f9fdb582fe6520e828c11fcb1d8ed26b6f105790307fd8394bf221de6819e",
    "repro/proof/vulnerable_1.config.response.headers": "ea120093b8b44847e6e6eb4bf4d24d44198b0e97226e67f56f5627e0692a1e97",
    "repro/proof/vulnerable_1.route.request.txt": "7a5c50622ba9a25ae6b6cd7c8a17350ac5488e648db1b482cdbe514e072e7025",
    "repro/proof/vulnerable_1.route.response.headers": "412444cd2d7c22008a0c26d16fb7edafe89b2f9c053e97523799bf02529b3247",
    "repro/proof/vulnerable_1.route.response.body": "22f3e5d6a750ce00e9248adee576d665f35bab17ca716d24434e5a77e8b251ea",
    "repro/proof/vulnerable_1.marker.txt": "29cee9e365331a4640641bfe12b0f056ee2e6bb01939413762045b836da19778",
    "repro/proof/vulnerable_1.observation.json": "fac595fecca4736998112860de621e78c7d3c5519f378ada6551c2a8e8dc0acc",
    "repro/proof/vulnerable_1.rename.response.headers": "7662935dc15e9eb52742d39b18cb55e8589d34865c8a9b4a6b2fb3b4d3e18943",
    "repro/proof/vulnerable_1.target.response.json": "fd7a4efd88b19ddbc1d928c7ef7560b662a36ebad713879f75045bc52a58ef7c",
    "repro/proof/vulnerable_1.owned.response.json": "3b92b02422fc6a412e8cfb3086329a449cbff1eb25c8c6db49d3763a5ccca9b8",
    "repro/proof/vulnerable_1.result.txt": "630603266ad8e99622dd2981f4a463d815d013b50b8652fb25315ce3a2bfdec5",
    "repro/proof/vulnerable_2.service.log": "d7959d9565171a1809da32f3979da6873a3d52e424ab46b613578d5683c05ace",
    "repro/proof/vulnerable_2.config.request.xml": "c98f9fdb582fe6520e828c11fcb1d8ed26b6f105790307fd8394bf221de6819e",
    "repro/proof/vulnerable_2.config.response.headers": "c5c0b84d00b08e8a81896f34a2a2d870034fbe20a761acec26c2596af38110ed",
    "repro/proof/vulnerable_2.route.request.txt": "b44c06cd450a8df3a4b95a59dc20ee2938b7300419c0e3b7d9950d6cde48fdb6",
    "repro/proof/vulnerable_2.route.response.headers": "f7ecf421b74edd92896fef0ae81d4249083fd9381648ded125b77be871054605",
    "repro/proof/vulnerable_2.route.response.body": "69056f418c4527cedfcf98dbe3e06702629e409d49e869f6725096b1b83dddfb",
    "repro/proof/vulnerable_2.marker.txt": "f74ae03b098e747729c3d4a36014f872cef1420fb26593f04b0a1c3e0055e1f7",
    "repro/proof/vulnerable_2.observation.json": "abcec335b970512551edd44c0335efbb96c4a9fd03d3e43eb60f1f5db2e0d8bf",
    "repro/proof/vulnerable_2.rename.response.headers": "70bbae8cf888f4a0da65f964e5d4ea2b954c26591d9902fc1a150ed16be7993e",
    "repro/proof/vulnerable_2.target.response.json": "b80c3b756b228684fe1ce231cc5b76a770fd4cb70910b7808afa012aec8e98ab",
    "repro/proof/vulnerable_2.owned.response.json": "d0362a3ddb96fdc73b292bd667622bc6599f5f1696e95821e190cca6e664e68d",
    "repro/proof/vulnerable_2.result.txt": "64a3720118567f18022661e7dc25264bbf1d5a6ba753028da8029e4df2def94c",
    "repro/proof/fixed_1.service.log": "1b8c3843bf7d320029b256d623f66564b48cb8a741539f241a1268b7af70341c",
    "repro/proof/fixed_1.config.request.xml": "c98f9fdb582fe6520e828c11fcb1d8ed26b6f105790307fd8394bf221de6819e",
    "repro/proof/fixed_1.config.response.headers": "1c5b0cd2d20192fab05581ff34e0b0f7156d2e82361071708e264b7b0ca403c3",
    "repro/proof/fixed_1.route.request.txt": "1f0ecfc28e8d18befb068685ad72ba3e9a4acb45c7e2f87b77b7d200f016b55d",
    "repro/proof/fixed_1.route.response.headers": "36a95645d43bf8c16028b08127b5c87f24b3c600bf125a5e6ec48c7ebfcd6bf1",
    "repro/proof/fixed_1.route.response.body": "3d347e4158d67d24069741ae6157fc73a01f545cd03b58d2e977317760a44fc2",
    "repro/proof/fixed_1.marker.txt": "4eb79fe54d576b21474b02075da64081445353039f798cd36d9432097a1c479c",
    "repro/proof/fixed_1.observation.json": "f41c300e81f2d65e425b5cfc7c8c836710a28eea74ae86c27df989197c3d27b4",
    "repro/proof/fixed_1.rename.response.headers": "0242cca0e84a9026501749bf1dc686955cdcc457aec591c183d64aca817ba2fe",
    "repro/proof/fixed_1.target.response.json": "53528963112715713db7a01f19b3e5b39ff198be41d3613d85c48b32f7e457d9",
    "repro/proof/fixed_1.owned.response.json": "1896dbcb9fd39bd23f9a154892a4c0c959f2413630942b3f573e75ef51d9ab82",
    "repro/proof/fixed_1.result.txt": "fe524ba8cfd916e93ba19257d9bc2ce925cc2c6c4344e6cf7684ecee3b851cd4",
    "repro/proof/fixed_2.service.log": "e4f97a357c1d6f4e316cb081e1ce8b97ca8048b54b6ed7bcdec640bf42398f7b",
    "repro/proof/fixed_2.config.request.xml": "c98f9fdb582fe6520e828c11fcb1d8ed26b6f105790307fd8394bf221de6819e",
    "repro/proof/fixed_2.config.response.headers": "13c6cb7d913799bb1877158e955aa0d05775d2662b268ea1c08d5edd4ac6c404",
    "repro/proof/fixed_2.route.request.txt": "a3fa7c0e004f18005b0ac3756ac3ac7dd32bc0d8c62d04d38f9fdd0d21b16a9e",
    "repro/proof/fixed_2.route.response.headers": "f13c7a8e2be2f88316fc8029e21c239cdd831d8fd7807f84548f10aaeaf0ffe4",
    "repro/proof/fixed_2.route.response.body": "c05181756dee6773d8aa647d56cb1913f4388f1057b9acfaec29ef653cbb901b",
    "repro/proof/fixed_2.marker.txt": "3904b91fc1f49e57f528b0dc9189bf34cb4511de7e7b0d12b9d5c05d08a8154f",
    "repro/proof/fixed_2.observation.json": "9982f977d2990ba6a8c428665575063ab1c166303a84f0fd66839e7182ea9e2b",
    "repro/proof/fixed_2.rename.response.headers": "b986b9d0da780662cf7e534e4af42414f9f85208cbab2b98a903c6f9f09377a8",
    "repro/proof/fixed_2.target.response.json": "fb4de44457899e8155aabac7f4263889d5c7dbd1e8efc42465d941d5489d88e1",
    "repro/proof/fixed_2.owned.response.json": "98e87484f1bac63129087869a7d7b435acd72d59a19f597dd717292a4b9e03f7",
    "repro/proof/fixed_2.result.txt": "a4cdb2e54199db21ecdf2f94828f913dad6313eb0b80897b81887a5b421b11d3"
  },
  "notes": "Two fresh vulnerable and two fresh fixed production HTTP controller attempts. Vulnerable transient object references forge a Stapler route to a nested Jenkins object with an unsecured ACL, executing attacker-selected Groovy and /bin/sh commands; transient name overwrite also removes the protected target entry. Fixed controllers create no marker and preserve target."
}