# SEVERITY-GATE - The Hard Gate

This is the gate every candidate must pass before it can become a finding report. It encodes Zion's

P1 "holy-shit" impact taxonomy as **eight impact families**. For each family it states the **exact

oracle** that counts as PROVEN, and the **v1 overclaim traps** that do NOT count.

**The binding rule:**

> Cyclops MUST NOT open a finding report unless the candidate is on a *demonstrable path* to one of

> the eight families below, **and** the family's oracle has fired (per [[OPERATING-CORE#3-proof-labels-the-four-states-a-candidate-can-be-in|proof labels]]).

> Anything below this bar - hardening notes, missing headers, blind reachability, info leaks without

> impact - goes to the [[../04-cleared-axes/README|cleared-axes log]], **never** to a report.

"Demonstrable path" means: at SOURCE_CONFIRMED time you can name the endpoint of the chain and it is

one of these families. If the best honest endpoint is "attacker can read an object they shouldn't" -

that is not on this list, and you stop and log it.

---

## Family 1 - Remote Code Execution (the crown)

Covers: Unauth RCE, Pre-Auth RCE, Wormable RCE, RCE via Deserialization / File-Upload /

Template-Injection (SSTI) / Command-Injection / SQLi-to-RCE, Reverse Shell, Web Shell.

**PROVEN (oracle):** code we chose runs in the target process. The artifact is one of:

- A callback to our listener (`curl`/DNS/TCP) from the target host, fired by our payload.

- `id` / `uname -a` / `hostname` output returned through the exploit channel.

- A file we wrote to the target FS from inside the target process (`/tmp/cyclops-$RAND`).

- For wormable: the above **plus** a demonstrated propagation primitive (the same payload reaches the

  next host with no new auth).

**Does NOT count (v1 traps):**

- "The deserializer accepts our object" - until a gadget chain actually executes, this is

  SOURCE_CONFIRMED at best. *Reaching* `pickle.loads` / `yaml.load` / `ObjectInputStream` is a

  hypothesis; a popped shell is the finding.

- "SSTI: `{{7*7}}` reflected `49`" - that is template *evaluation*, not yet RCE. The finding is

  `{{ cycler.__init__.__globals__.os.popen('id') }}` (or the engine's equivalent gadget) returning

  command output. Expression eval alone goes no further than SOURCE_CONFIRMED.

- "The upload endpoint accepts a `.php`/`.jsp`" - until the shell is *reached and executes*, you have

  an upload, not RCE. Prove the webroot path is served and the handler runs.

- "Command string is built from user input" - concatenation is a hypothesis; you need the injected

  command's *output* or callback.

---

## Family 2 - Container / VM / Sandbox / Hypervisor Escape & Orchestrator Takeover

Covers: container breakout, VM/sandbox/hypervisor escape, Kubernetes / Docker-socket takeover,

kernel / bootloader / firmware compromise.

**PROVEN (oracle):**

- **Container/sandbox escape:** a read or write on the **host** filesystem or host process namespace

  from inside the container (e.g. our canary file at `/host-canary` created from the container; a

  process visible in the host PID namespace; reading the host's `/etc/shadow` via an escaped mount).

- **Docker-socket / K8s takeover:** scheduling a pod/container we control on a node we should not

  control, proven by command output from that node, **or** reading a cluster secret

  (`/var/run/secrets/kubernetes.io/serviceaccount/token`) that grants cross-namespace action we then

  demonstrate.

- **Hypervisor escape:** guest-to-host code execution proven by an artifact on the host.

- **Kernel/firmware:** a controlled kernel crash with attacker-controlled fault (ASan/KASAN/oops with

  our pattern in RIP/registers), or a privilege transition to ring-0 capability demonstrated.

**Does NOT count:**

- "We are root *inside* the container." That is the starting position, not an escape.

- "The container has `CAP_SYS_ADMIN` / a mounted socket." That is a misconfig *observation*; the

  finding is the demonstrated breakout using it.

- "Node-to-node lateral movement is theoretically possible." Demonstrate the second node or it is

  SOURCE_CONFIRMED.

---

## Family 3 - Cloud / Identity Account Takeover & Privilege Escalation

Covers: cloud (AWS/Azure/GCP) account takeover, IAM priv-esc to admin, cross-tenant / tenant-isolation

break, SSO/SAML/OAuth bypass + ATO.

**PROVEN (oracle):**

- **Cloud ATO:** credentials (access key, session token, service-account JSON) retrieved **and** used

  to perform an action we were not entitled to, proven by the API response (e.g.

  `sts:GetCallerIdentity` returning a role we hijacked, then a `s3:ListBucket` on a bucket we should

  not see - against *our own* canary resources where possible).

- **IAM priv-esc:** starting principal A, end as admin/role B, proven by an action only B can take.

- **Cross-tenant break:** reading or mutating **tenant B's** data while authenticated as **tenant A**

  - with both tenants being *our own* planted accounts holding canary data. The artifact is tenant

  A's session returning tenant B's canary.

- **SSO/SAML/OAuth bypass:** a forged/relayed assertion or bypassed check that logs us in as a

  *different* user (our second canary user), proven by that user's authenticated session.

**Does NOT count (the biggest v1 trap):**

- **"Injection reachable" ≠ "ATO completes."** A JWT with `alg:none` *accepted* by a debug endpoint

  is not ATO until you forge a token for a *privileged* user and perform a privileged action with it.

- "The OAuth `redirect_uri` allows an open redirect" - that is a redirect; ATO needs the *token/code*

  captured and exchanged for a session.

- "IDOR lets me read another user's profile" - cross-object read of low-value data is **not** a

  tenant-isolation break unless it crosses a tenant trust boundary into material data. Most IDOR is

  cleared-axes, not a finding. (This is the exact class v1 over-reported.)

- "SAML response is not signed-checked in this code branch" - prove the forged assertion yields a

  session; a missing check that some upstream guard catches is DISPROVEN.

---

## Family 4 - Secret / Key / Repo / Build-Pipeline Compromise

Covers: JWT signing key / API key / private key / production secret / CI-CD secret compromise;

source-repo / GitHub-org / Actions-runner / build-pipeline takeover.

**PROVEN (oracle):**

- **Secret exfil:** the actual secret value retrieved through the exploit channel (the signing key

  bytes, the live API key, the `.env` contents) - verified live where safe by a *minimal* benign use

  (e.g. the API key returns `200` on a `whoami`-style endpoint; the JWT key validates a token we sign).

- **Repo/org takeover:** a write we land on a repo/org we should not control - a commit/branch/tag we

  pushed to a protected target (against *our own* canary repo for replica proof), or a workflow we

  caused to run with elevated `GITHUB_TOKEN` permissions.

- **Actions-runner / pipeline takeover:** code execution on the runner proven by an artifact (callback

  from inside the CI job, or exfil of `secrets.*` / the `GITHUB_TOKEN` to our listener). See

  [[../01-archetypes/cicd-supplychain]].

**Does NOT count:**

- "This key *looks* like a secret in the JS bundle" - a string that matches a regex is a hypothesis.

  Prove it is live and grants access (minimal benign call), or it is cleared-axes.

- "The workflow uses `pull_request_target`" - that is a *risky pattern*; the finding is the actual

  secret/token exfil it enables. Prove the injection executes in the privileged context.

- "An expired / revoked / sandboxed test key." Dead keys are not findings.

---

## Family 5 - Supply-Chain & Dependency Compromise

Covers: supply-chain / dependency-confusion / registry / artifact / signing-key compromise.

**PROVEN (oracle):**

- **Dependency confusion:** a package *we* published to a public registry under an internal name is

  pulled and **executed** by the target's build/install (callback from the install/postinstall step,

  proven against our own replica build). The artifact is the callback, not the namespace being claimable.

- **Artifact/registry poisoning:** a malicious artifact we placed is consumed and run downstream,

  proven by execution in the consumer.

- **Signing-key compromise:** the signing key retrieved (Family 4 oracle) **and** a malicious artifact

  signed-and-accepted by a verifier we don't control.

**Does NOT count:**

- "This internal package name is unclaimed on npm/PyPI." Claimability is SOURCE_CONFIRMED. Publishing

  a benign canary package and observing the *target's pipeline pull and run it* is the finding - and

  only against in-scope / owned pipelines. **Never** squat a name a non-consenting third party builds.

- "The lockfile has a typo-squat-adjacent name." Adjacency is not consumption.

---

## Family 6 - Mass Data Exfil & Financial Impact

Covers: mass PII / DB / payment-data exfil; financial theft / payment bypass / balance manipulation;

ransomware / data-destruction paths.

**PROVEN (oracle):**

- **Mass exfil:** a query/endpoint returning bulk records across the authorization boundary, proven on

  a replica seeded with canary PII - the artifact is the bulk canary set returned to an unprivileged

  principal. (Live: prove the primitive with a `COUNT(*)` or a single canary row, never bulk-pull real

  user data.)

- **Financial:** a state transition that moves value - balance increased, a payment accepted at the

  wrong price, a refund issued without debit - proven by the post-state on a replica/canary account.

- **Data destruction/ransomware path:** a demonstrated unauthorized write/delete primitive on data we

  planted, with the destructive step proven on a canary only.

**Does NOT count:**

- "The endpoint *could* return many rows if the `WHERE` were dropped." Demonstrate it.

- "**Read DoS** / a slow query / a large response." A denial-of-service or resource-exhaustion read is

  **not** RCE and not exfil. (Explicit v1 trap: do not dress up a DoS as a critical.)

- "The price is set client-side." Client-side observation is a hypothesis; prove the server accepts

  the manipulated value and the order/state actually changes.

- "I can see *one* of my own orders." Not mass, not cross-boundary.

---

## Family 7 - SSRF / XXE / File-Access Chains to Critical

Covers: SSRF→metadata / →internal-admin / →RCE; XXE→file-read; arbitrary file read of secrets;

arbitrary file write→RCE; path-traversal→secrets.

**PROVEN (oracle):**

- **SSRF:** must terminate in impact, not just an outbound request. PROVEN = the metadata credential

  retrieved (`169.254.169.254/latest/...` token *captured*), **or** an internal-admin action performed

  via the SSRF, **or** SSRF→RCE chained to a Family-1 artifact. A bare OOB callback proves *blind

  SSRF reachability* - that is SOURCE_CONFIRMED, not a finding on its own (see trap below).

- **XXE / arbitrary file read:** the *contents* of a real secret file retrieved through the channel -

  our canary at `/etc/cyclops-canary` for replica proof, or a genuinely sensitive file

  (`/etc/passwd` is a demo, a signing key / `.env` is the impact) on a permitted target.

- **Arbitrary file write→RCE:** the write lands somewhere that executes (cron, webroot, a `.so`/

  `.pth`/startup path) and the execution fires a Family-1 artifact. The write alone is not the finding;

  the resulting execution is.

- **Path-traversal:** the traversal returns secret contents, per the file-read oracle.

**Does NOT count (the canonical v1 trap):**

- **"Blind SSRF confirmed by a DNS callback"** with nothing behind it. Per Zion's standing rule, never

  submit enumeration / blind SSRF standalone - prove the full impact chain (metadata cred, internal

  admin, or RCE). Blind callback → cleared-axes or keep-pulling, not a report.

- "Traversal reads `/etc/passwd`." `/etc/passwd` is a *demonstration of the primitive*, not impact by

  itself on a modern box. Pull a real secret to cross into a finding.

- "File write to a `/tmp` no one executes." A write with no execution sink is SOURCE_CONFIRMED.

---

## Family 8 - Exposed Critical Service & Trust-Infrastructure Compromise

Covers: the "exposed service" family - Jupyter / Redis / Mongo / Elasticsearch / Jenkins / Grafana /

K8s-dashboard / Prometheus / Terraform-state / env-var exposure; **and** trust-infra compromise:

MFA / password-reset / session-hijack / WAF bypass to a critical action; AD / domain-admin /

golden-ticket / NTLM-relay; DNS / registrar / subdomain / email / BGP / CA / TLS-key compromise.

**PROVEN (oracle):**

- **Exposed service:** not "the port is open" - the **unauthed privileged capability exercised**. For

  Jupyter, a notebook executing `os.system` (Family-1 artifact). For Redis, an unauthed write we then

  turn into RCE (module load / cron / authorized_keys) or a secret read. For Terraform-state, the

  *secrets inside the state* retrieved. For an exposed `.env`, the secret retrieved **and** minimally

  validated live. The artifact is the capability, not the banner.

- **Trust-infra:** the takeover demonstrated - a subdomain we now serve content on (dangling

  CNAME claimed against *our own* canary), a password-reset flow yielding a *different* user's session

  (our second canary user), an NTLM relay landing an authenticated action as the relayed principal,

  a golden ticket authenticating as a domain principal in our lab forest.

**Does NOT count:**

- "Redis/Mongo/ES is reachable without auth." Exposure is the start. The finding is the data read or

  the RCE landed. (Many "exposed service" reports are really just a port scan result - that is

  cleared-axes until the capability fires.)

- "Grafana is on the internet." Until you prove the unauthed read of a datasource secret or an

  exploit, it is an observation.

- "The reset token is predictable-looking." Predict it and take over the canary account, or it is

  SOURCE_CONFIRMED.

- "A WAF can be bypassed." A bypass that reaches a *non-impactful* endpoint is nothing; the bypass

  must reach a critical action that then fires another family's oracle.

---

## Gate decision procedure (run this on every candidate)

1. **Name the endpoint.** Honestly, what is the *best* impact at the end of this chain? Write it down.

2. **Map it to a family.** Is that endpoint one of Families 1-8? If no → [[../04-cleared-axes/README|cleared-axes]], stop.

3. **Identify the oracle.** What single artifact would prove it? If you cannot name an artifact, the

   candidate is not yet SOURCE_CONFIRMED - it is a guess.

4. **Check it is novel, not a sibling-CVE.** Run the [[../06-methods/NOVELTY-DOCTRINE|novelty check]]

   *before* deep work.

5. **Drive the oracle on a replica.** Artifact → REPLICA_CONFIRMED. No artifact → DISPROVEN + log.

6. **Only now** may a report exist. And only if in scope may a LIVE_CANARY_CONFIRMED follow.

> If you find yourself writing a report whose impact section says "could", "may", "potentially",

> "an attacker might", or "this is likely exploitable" - you have failed the gate. Delete it and go

> get the artifact, or log it DISPROVEN.