{
  "_pruva_terminal_reconciliation": {
    "authored_artifact_closure_sha256": "08261ec6466f170a4f79f03f441654feed103843d103b5aec3fb810891e4e4cc",
    "authored_runtime_manifest_sha256": "52b58a9e3ec87c1ad69239db4c6a24abb74da28b140138924bcaecfe561aaf4c",
    "authored_verdict_sha256": "043d48850448f21a0a04e7887be073bdd080963665aa69e4cfc209dc3ba7de26",
    "claim_matching": "evaluated",
    "schema_version": 2,
    "status": "completed"
  },
  "attacker_controlled_input": "tenant_subdomain parameter passed to TokenProvider.get_token()",
  "claim_outcome": "confirmed",
  "claimed_impact_class": "ssrf",
  "claimed_surface": "library_api",
  "crash_observed": false,
  "end_to_end_target_reached": true,
  "evidence_scope": "production_path",
  "exploit_chain_demonstrated": true,
  "exploitability_confidence": "high",
  "inferred": false,
  "observed_impact_class": "ssrf",
  "read_write_primitive_observed": false,
  "repro_result": "confirmed",
  "sanitizer_used": false,
  "trigger_path": "sap_cloud_sdk.destination._http.TokenProvider.get_token() -> token_url.replace(identityzone, tenant_subdomain) -> OAuth2Session.fetch_token() to attacker host",
  "validated_surface": "library_api"
}