{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /uploads (Active Storage attach) on a Rails 8.0.5.1 app with variant_processor=:mini_magick and the Disk service; ImageMagick analyzer runs at attach time",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "ruby-3.4",
    "rails-8.0.5.1-activestorage",
    "mini_magick-5.0",
    "imagemagick-7.1.1-32",
    "puma",
    "sqlite3"
  ],
  "target_identity": {
    "repository_url": "https://github.com/rails/rails",
    "commit_sha": "7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c",
    "target_digest": "ca8f601522abe5ce8e5f9cac062820fc77f2b0be2ae4ed0a9340b969d7ac31cd",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/attempts/fixed_1/attack.log",
    "logs/attempts/fixed_1/attack.stdout",
    "logs/attempts/fixed_1/server.log",
    "logs/attempts/fixed_1/summary.json",
    "logs/attempts/fixed_2/attack.log",
    "logs/attempts/fixed_2/attack.stdout",
    "logs/attempts/fixed_2/server.log",
    "logs/attempts/fixed_2/summary.json",
    "logs/attempts/vuln_1/05_payload_env1024.msl",
    "logs/attempts/vuln_1/10_arbitrary_write.txt",
    "logs/attempts/vuln_1/11_exfil_blob_download.bin",
    "logs/attempts/vuln_1/11b_exfil_canary_download.bin",
    "logs/attempts/vuln_1/12_exfil_environ.txt",
    "logs/attempts/vuln_1/13_response_after_template_write.html",
    "logs/attempts/vuln_1/14_rce_marker.txt",
    "logs/attempts/vuln_1/attack.log",
    "logs/attempts/vuln_1/attack.stdout",
    "logs/attempts/vuln_1/server.log",
    "logs/attempts/vuln_1/summary.json",
    "logs/attempts/vuln_2/05_payload_env1024.msl",
    "logs/attempts/vuln_2/10_arbitrary_write.txt",
    "logs/attempts/vuln_2/11_exfil_blob_download.bin",
    "logs/attempts/vuln_2/11b_exfil_canary_download.bin",
    "logs/attempts/vuln_2/12_exfil_environ.txt",
    "logs/attempts/vuln_2/13_response_after_template_write.html",
    "logs/attempts/vuln_2/14_rce_marker.txt",
    "logs/attempts/vuln_2/attack.log",
    "logs/attempts/vuln_2/attack.stdout",
    "logs/attempts/vuln_2/server.log",
    "logs/attempts/vuln_2/summary.json"
  ],
  "artifact_sha256": {
    "logs/attempts/fixed_1/attack.log": "1b74e686fce55fe91a37276348ea7a18a64ddb11bce3f1fc2dd76a8afd6c3729",
    "logs/attempts/fixed_1/attack.stdout": "940ed327eacae2451647d61475024b9bedc501ea01fc8a2c4d9726dcdc15b2bf",
    "logs/attempts/fixed_1/server.log": "b735e0f0c22cf226aef739281714a3790b4be4362735b3549d6b34aa0267939a",
    "logs/attempts/fixed_1/summary.json": "69687f81e5e00c45c6deb735bddac8fbd5425f321ec510adff1fa8607eb8ac59",
    "logs/attempts/fixed_2/attack.log": "29a1201cbceb7833e9c44d39c3ffa2f3f856e587a44fa8e9d904170db3839888",
    "logs/attempts/fixed_2/attack.stdout": "91beb5445e4fa7cb41890dc0007927e64679faa8be6a1bc27e6a34642ced2fe4",
    "logs/attempts/fixed_2/server.log": "7d84e246888a7730d4bde95cba078a6f9634c5cb599351041e0ee4fe3188e938",
    "logs/attempts/fixed_2/summary.json": "1650ab6484cac67f855991b10ab1300d032ad0fd61d0b51b98cdfb17cf051e05",
    "logs/attempts/vuln_1/05_payload_env1024.msl": "21ec17fcdce93428dd2f4d2261fc9e1d12df63f9daa0c39657c110985963597a",
    "logs/attempts/vuln_1/10_arbitrary_write.txt": "c26fb734ab8df312fc796cc3342b96956841fab167c5929735f2c48d6c4300c8",
    "logs/attempts/vuln_1/11_exfil_blob_download.bin": "cdb69dab744e89d8a73738304fbcfed6d2bc83ab89eadac11c21c320bc3a6847",
    "logs/attempts/vuln_1/11b_exfil_canary_download.bin": "90a60247678e05229e8c9db4c3ce4d5872eed08e237fd6c31e00430b2810ed19",
    "logs/attempts/vuln_1/12_exfil_environ.txt": "ca38c6b3e6cabd64883c3b0cf88c26affb4cfccf2a560c22bfed8a172d0d6395",
    "logs/attempts/vuln_1/13_response_after_template_write.html": "bc1871482657416bc099f0a6bf19a3f7176bfb43324d281ed1a6af09741ad5f4",
    "logs/attempts/vuln_1/14_rce_marker.txt": "bd490118370c9d21ceb053bc9666d0a143b0eeb897995d0f51d4a63bf6f12f67",
    "logs/attempts/vuln_1/attack.log": "baa5ac94f73f3a4f5d0e6f4d0a15304d892b253cf8c092f4f6a2142540adaa61",
    "logs/attempts/vuln_1/attack.stdout": "72dd0f3cfd5e5cd0e0ab58e589940f6fdd8f951ba98e2e3641aa51d278fcd038",
    "logs/attempts/vuln_1/server.log": "9ce94128567964c5d902c43a7b25781e6c232e73da0ac14883bafa8f20038d0b",
    "logs/attempts/vuln_1/summary.json": "601f87dbd31fe12dffa17370953d0d1116465a2ed994a6a89a8957d96d807532",
    "logs/attempts/vuln_2/05_payload_env1024.msl": "7ec8a14113370c863587653be614ae23d079421e08800c767729466c67de9543",
    "logs/attempts/vuln_2/10_arbitrary_write.txt": "bfe211d0ef4f5a4fa26e1e1221d7b88a5a1c0403366f76a811dfd05dcb918da7",
    "logs/attempts/vuln_2/11_exfil_blob_download.bin": "cdb69dab744e89d8a73738304fbcfed6d2bc83ab89eadac11c21c320bc3a6847",
    "logs/attempts/vuln_2/11b_exfil_canary_download.bin": "90a60247678e05229e8c9db4c3ce4d5872eed08e237fd6c31e00430b2810ed19",
    "logs/attempts/vuln_2/12_exfil_environ.txt": "ca38c6b3e6cabd64883c3b0cf88c26affb4cfccf2a560c22bfed8a172d0d6395",
    "logs/attempts/vuln_2/13_response_after_template_write.html": "bffc190d63f27b06ac5398933dc4d104c0181deb800c8c2b89229056a993837d",
    "logs/attempts/vuln_2/14_rce_marker.txt": "ad2d2240808b4bae2eb4a345923cb27d8c8f27ef97458eaba4cef5ed22d8e0a0",
    "logs/attempts/vuln_2/attack.log": "ea60ab86fb08bce5057ade00010e4183df37ee96a87ddbb5d5b38f5a0692103a",
    "logs/attempts/vuln_2/attack.stdout": "45169a7744b392142cdbc2ba9ac39d0924c74bff3f71a6cf05a4473a922a6f11",
    "logs/attempts/vuln_2/server.log": "c14fc718056c8cb401148e59b0b59d3ec6743141e9abf3f01215c9d3dbcbf8d6",
    "logs/attempts/vuln_2/summary.json": "dc5ec8dee0c7c26e243558cca479ff6fcc7e89658709d70459b530f68977efcd"
  },
  "notes": "attacker-controlled SVG reached ImageMagick MSL through the Active Storage image analyzer at attach time on activestorage 8.0.5.1: arbitrary file write, arbitrary file read of /proc/self/environ and of a planted credential file exfiltrated through the attacker's own blob, and code execution through a template the MSL write replaced. Fixed 8.0.5.2 refuses the MSL coder through the shipped ImageMagick policy."
}