{
 "entrypoint_kind": "open_document",
 "entrypoint_detail": "Victim opens the crafted ODS in LibreOffice Calc; the saved calcext:data-mapping (sql provider) is restored on load and reads a local text file into the sheet",
 "service_started": true,
 "healthcheck_passed": true,
 "target_path_reached": true,
 "runtime_stack": [
  "libreoffice-calc-26.2.4.2 (official deb build, vulnerable)",
  "libreoffice-calc-26.2.5.2 (official deb build, fixed control)",
  "attacker http host (python3 http.server serving evil.odb)"
 ],
 "target_identity": {
  "repository_url": "https://github.com/libreoffice/core",
  "target_digest": "810ef197e190d7804a60e0016052c46ff33792303a200fddda9d5216a64b9900",
  "runtime_digest": "810ef197e190d7804a60e0016052c46ff33792303a200fddda9d5216a64b9900",
  "platform": "linux",
  "architecture": "x86_64"
 },
 "proof_artifacts": [
  "repro/proof/vulnerable-1/crafted.ods",
  "repro/proof/vulnerable-1/leaked-sheet.csv",
  "repro/proof/vulnerable-1/http-server.log",
  "repro/proof/vulnerable-1/vulnerable-attempt-1.txt",
  "repro/proof/vulnerable-1/observation.json",
  "repro/proof/vulnerable-2/crafted.ods",
  "repro/proof/vulnerable-2/leaked-sheet.csv",
  "repro/proof/vulnerable-2/http-server.log",
  "repro/proof/vulnerable-2/vulnerable-attempt-2.txt",
  "repro/proof/vulnerable-2/observation.json",
  "repro/proof/fixed-1/crafted.ods",
  "repro/proof/fixed-1/leaked-sheet.csv",
  "repro/proof/fixed-1/http-server.log",
  "repro/proof/fixed-1/fixed-attempt-1.txt",
  "repro/proof/fixed-1/observation.json",
  "repro/proof/fixed-2/crafted.ods",
  "repro/proof/fixed-2/leaked-sheet.csv",
  "repro/proof/fixed-2/http-server.log",
  "repro/proof/fixed-2/fixed-attempt-2.txt",
  "repro/proof/fixed-2/observation.json"
 ],
 "artifact_sha256": {
  "repro/proof/vulnerable-1/crafted.ods": "dd0d6c574abf946ff8914cd54463b2558510e775c134cee6313ebe3a8171839d",
  "repro/proof/vulnerable-1/leaked-sheet.csv": "8afa1cb2868ec17f5909335568c1670cd3933b09c2dc524cdf2b6c9079f3c325",
  "repro/proof/vulnerable-1/http-server.log": "d98abb904610ebecd0469f19d183e20bee60afe9528f90b88ec840597d4ac33e",
  "repro/proof/vulnerable-1/vulnerable-attempt-1.txt": "119d310a678ac2c69a015bf95cfd4b94cbcbd76ecce6cd4a6d5903bb858234ff",
  "repro/proof/vulnerable-1/observation.json": "a0acacd3b06656d132ed439042b427509c4c00d16124924076121bab4e39c294",
  "repro/proof/vulnerable-2/crafted.ods": "e18ffbb463880335dda806dc770b75a612f741b2b57664925d9888ce67c1b8b0",
  "repro/proof/vulnerable-2/leaked-sheet.csv": "a68726c94d878d1e5cc1cf512a4ff3a427c3cc5e217543d4adc650e9050e4d6e",
  "repro/proof/vulnerable-2/http-server.log": "5b899cf040eae435ae035ed1fc6fd1950edc2e64f4e8b8ab8d75e6c1a030610a",
  "repro/proof/vulnerable-2/vulnerable-attempt-2.txt": "15d080c438041f6466e59fd91d77dd71e4141ae081f8ffdc2a1f5e90e10fdaa6",
  "repro/proof/vulnerable-2/observation.json": "d4efc8a1bef42e5090c4cc30f9ce2f6b2f0df4dc96ea0aed3bf44583cdc6efe8",
  "repro/proof/fixed-1/crafted.ods": "fbaf3f4ef4bf58b07f2ee9eeacebfdf8141db305b615d0fa8f8f10c31721aeb4",
  "repro/proof/fixed-1/leaked-sheet.csv": "492d5ea496056f1a6a6592241032fab764c321596317930b4fa0e1e8bc3b7470",
  "repro/proof/fixed-1/http-server.log": "7ecdc17a1fb10140265a574029dc3ffe312526b3f6fd3246a2c4246341649806",
  "repro/proof/fixed-1/fixed-attempt-1.txt": "44d5edc5470e6c809699f01a0c980566edd9ab7960c8b8d87bca67e9f0886f17",
  "repro/proof/fixed-1/observation.json": "309e04161ac14bf76a757613b0a48e5c983438015ae900f616a8e921b9b60959",
  "repro/proof/fixed-2/crafted.ods": "cdad777779d3968980d19535445f3df24f1fa52979108975d9cba5cbd60301ce",
  "repro/proof/fixed-2/leaked-sheet.csv": "492d5ea496056f1a6a6592241032fab764c321596317930b4fa0e1e8bc3b7470",
  "repro/proof/fixed-2/http-server.log": "e03a6419e4bdc2b303fa8bf120c391bdeba8279af44c62e9edccaa07204a2e5e",
  "repro/proof/fixed-2/fixed-attempt-2.txt": "319f83e4aebe4d55198423661dfbc153daac0058e80a462902a15f6923dc06ad",
  "repro/proof/fixed-2/observation.json": "69a75359ff8bba302e20713b181076cafab3e69876dc0d859dc30b8ad7892ecb"
 },
 "notes": "Vulnerable LibreOffice 26.2.4.2: both attempts leaked the unique victim secret marker into the exported sheet. Fixed LibreOffice 26.2.5.2: both attempts opened the same document without leaking (document-named sql data mapping ignored; attacker odb never fetched). Fix commit 104d2b4f5dae917661b20b18d5d2043fca4407e4 (parent b389e707d3a80ea7156808387fe6a2b1602c49d0)."
}