# ══════════════════════════════════════════════════════════════════
# submission_template_v10.yaml
# Samsung Mobile Security Rewards Program — Standard Submission Template v1.0
# ------------------------------------------------------------------
# Fully complete this form and attach it to your report, zipped together
# with your PoC artifacts.
# In the report itself, fill in the summary form provided by the reporting
# system. Put the detailed information in this file, which is the basis for
# validation and automated reproduction.
#
# · A report without a working PoC will be determined as Not Eligible.
# · A report submitted without this template, or with an incomplete
#   template, may receive a substantially reduced reward.
# · Use test accounts that you own. Do not submit other people's personal
#   data; where it is unavoidable as evidence, mask it before submission.
#
# Fields marked [R]  are REQUIRED and must be filled in.
# Fields marked [CR] are CONDITIONALLY REQUIRED depending on selected options (e.g., step type or if claiming ISVP).
# Fields marked [O]  are OPTIONAL but RECOMMENDED for faster analysis and reproduction.
# NOTE: Device-specific fields in the 'environment' section are NOT REQUIRED for Server/Cloud vulnerabilities.
# Field guide: https://security.samsungmobile.com/files/template_samples.zip   |   Contact: mobile.security@samsung.com
# ══════════════════════════════════════════════════════════════════

schema_version: "1.0"             # [R] template version (do not change)

# ─── Basic Information ────────────────────────────────────
metadata:
  target_title: ""                # [R] A concise title of the vulnerability.
                                  #     e.g., "Access control bypass in Example App"
  vuln_type: ""                   # [R] The general class of the vulnerability.
                                  #     e.g., "Access Control Bypass", "Out-of-Bounds Write", "Server-Side Request Forgery"
  target_component: ""            # [R] The vulnerable component, package, or library name.
                                  #     e.g., "com.example.vulnapp"
  target_version: ""              # [R] The specific version of the affected component.
                                  #     e.g., "1.2.3"
  description: ""                 # [R] A detailed technical description of the vulnerability.
                                  #     (Focus on the flawed logic, affected code path, and how it is triggered.
                                  #     The attack scenario and impact should be described below.)
  root_cause: ""                  # [O] Your analysis of the root cause.
  remediation: ""                 # [O] Your suggested remediation for the issue.
  practical_security_impact: ""   # [R] The final security impact proven by the PoC.
                                  #     e.g., "The PoC achieves arbitrary code execution in a privileged context."
                                  #     e.g., "This vulnerability allows a malicious app to steal user credentials."
  cwe: ""                         # [O] The most relevant CWE ID, if known.
                                  #     e.g., "CWE-787: Out-of-bounds Write"

# ─── Test Environment ─────────────────────────────────────
# NOTE: For Server/Cloud targets, device-specific fields below may be left blank or marked "N/A".
# (The 'attacker_prerequisites' field should still describe the required access level, e.g., authenticated user account.)
# ──────────────────────────────────────────────────────────
environment:
  device_model: ""                # [R] Factory model name.
                                  #     cmd: adb shell getprop ro.product.model
                                  #     e.g., SM-S948N (Galaxy S26 Ultra)
  build_fingerprint: ""           # [R] The active firmware build ID.
                                  #     cmd: adb shell getprop ro.product.build.fingerprint
  android_version: ""             # [R] Android OS version.
                                  #     cmd: adb shell getprop ro.build.version.release
                                  #     e.g., 16
  one_ui_version: ""              # [O] Samsung One UI version.
                                  #     cmd: adb shell getprop ro.build.version.oneui
                                  #     e.g., 80500
  security_patch_level: ""        # [R] Security Patch Level (Format: YYYY-MM-DD).
                                  #     cmd: adb shell getprop ro.build.version.security_patch
                                  #     e.g., 2026-09-01
  attacker_prerequisites:         # [R] Minimal preconditions required to execute the exploit (at least one).
    - ""                          #     e.g., "Untrusted third-party app with no permissions installed"
                                  #     e.g., "Physical access to the device with screen locked"
                                  #     e.g., "Local shell access via ADB"

# ─── ISVP (Important Scenario Vulnerability Program) ──────
# Complete this section ONLY if you are claiming an ISVP reward.
# ISVP is a special reward tier with the strictest requirements. It is
# paid only to reports that satisfy all conditions, including a working PoC
# and a fully completed template. If any requirement is not met, the report
# is assessed for the standard base reward and Good Report Bonus instead.
#
# If 'claimed' is set to false, all [CR] fields below may be left blank.
# ──────────────────────────────────────────────────────────
isvp:
  claimed: false                  # [R] Are you claiming an ISVP reward? (true | false)
  scenario: ""                    # [CR] Required if claiming ISVP. Choose exactly one:
                                  #      ace_privileged_target | device_unlock_and_data_extraction | arbitrary_installation
  target: ""                      # [CR] Required if claiming ISVP. Must match the chosen scenario above:
                                  #      - ace_privileged_target             -> knox_vault | teegris_os | rich_os
                                  #        (NOTE: teegris_os refers to the Secure OS itself; trustlets are excluded)
                                  #      - device_unlock_and_data_extraction -> before_first_unlock | after_first_unlock
                                  #      - arbitrary_installation            -> official_store | attacker_server
  attack_vector: ""               # [CR] Required if claiming ISVP (local | adjacent | remote | physical).
  unprivileged_execution: false   # [CR] Required if claiming ISVP. Does the exploit execute without initial privileges? (true | false)
  verified_on_latest_flagship: false  # [CR] Required if claiming ISVP. Tested on the latest flagship's latest security update?
  buildable_exploit: ""           # [CR] Required if claiming ISVP. Filename of the buildable exploit.
                                  #      (This file MUST be listed in the artifacts section with type: exploit)
  scenario_evidence: ""           # [CR] Required if claiming ISVP. Detailed explanation of how the exploit proves the scenario.
  user_interaction: ""            # [O] none (0-click) | one_click | multi_step
  persistence: ""                 # [O] none | survives_reboot | survives_factory_reset
  code_composition: ""            # [O] samsung_mobile_only | samsung_and_other_vendor | samsung_ds_only | other_vendor_only
                                  #     (For Rich OS ISVP: 'samsung_mobile_only' receives full reward;
                                  #     combinations with 3rd-party code receive partial; 'other_vendor_only' is not eligible.)
  notes: ""                       # [O] Any partial success or additional context for the ISVP claim.

# ─── Reproduction Automation ──────────────────────────────
# Declaring fully_automated: true lets us route your report directly to
# automated reproduction, which typically means a faster review.
# ──────────────────────────────────────────────────────────
automation:
  fully_automated: false          # [R] Set to true ONLY if every step in reproduction_steps is adb/script,
                                  #     requires zero physical interaction, and success is verifiable
                                  #     via verification_hints. (true | false)
  notes: ""                       # [O] Special instructions or environmental requirements for the pipeline.
                                  #     e.g., "Requires an active cellular data connection (SIM inserted)"
                                  #     e.g., "Must be pre-logged into a Samsung Account"

# ─── Reproduction Steps ───────────────────────────────────
# List as many steps as needed to reproduce the vulnerability.
# The four steps below are reference examples and do not represent a mandatory sequence.
#
# Each step type requires specific fields (Condition Required [CR]):
#   - If type is 'adb'    -> 'command' is REQUIRED [CR]
#   - If type is 'script' -> 'script_path' is REQUIRED [CR]
#   - If type is 'manual' -> 'action' is REQUIRED [CR]
#
# WARNING: Automated adb/script steps execute within a sandboxed environment.
# Destructive or system-breaking commands (e.g., 'rm -rf /', 'reboot recovery',
# 'factory reset' via adb) are strictly prohibited and will result in the immediate
# rejection of your submission.
# ──────────────────────────────────────────────────────────
reproduction_steps:
  - step: 1
    type: adb                     # adb | script | manual
    command: ""                   # [CR] e.g., adb install -r reader.apk
    description: ""               # [O]  A short, human-readable summary of this step.
    timeout_sec: 30               # [O]  Max execution time in seconds (Default: 30).
  - step: 2
    type: adb
    command: ""                   # [CR] e.g., adb shell am start -n com.example.reader/.MainActivity
    description: ""
    timeout_sec: 30
  - step: 3
    type: script                  # Executes an attached shell script.
    script_path: ""               # [CR] e.g., poc_adb.sh (Must be included in artifacts)
    description: ""               # [O]  A short summary of what the script does.
    timeout_sec: 60               # [O]  Max execution time in seconds (Default: 60).
  - step: 4
    type: manual                  # Performed manually by the reviewer.
    action: ""                    # [CR] e.g., "Settings -> [Target App] -> Confirm Bypass"
    expected_result: ""           # [O]  e.g., "Protected screen renders without authentication"

# ─── Expected Result ──────────────────────────────────────
expected_result:
  type: ""                        # [R] Classification code. Choose exactly one from below:
                                  #     info_leak | privilege_escalation | rce | dos | auth_bypass | other
  description: ""                 # [R] A clear description of the successful exploit state.
  evidence: ""                    # [R] Summary of success evidence (e.g., "Verification toast shown").
                                  #     (NOTE: Specific machine-readable markers must go in verification_hints below)

# ─── Attached Files ───────────────────────────────────────
# List all files submitted in your ZIP archive.
# [CR] Any files referenced in other sections (e.g., 'script_path' or
# 'buildable_exploit') MUST be listed here with the correct type.
#
# 'buildable_source: true' is strongly recommended for all source code
# and script artifacts to ensure reproducibility.
# ──────────────────────────────────────────────────────────
artifacts:
  - filename: "poc.apk"
    type: apk                     # apk | source | script | binary | exploit | screenshot | video
    description: "Installable PoC application." # [O]
    buildable_source: true        # [O]

  - filename: "poc_source.zip"
    type: source
    description: "Android Studio project (gradle buildable)." # [O]
    buildable_source: true        # [O]

  - filename: "poc_adb.sh"
    type: script
    description: "ADB automation script (if used in reproduction_steps)." # [O]
    buildable_source: true        # [O]

  - filename: "reproduction.mp4"
    type: video
    description: "A single-take video demonstrating the issue (strongly recommended for manual steps)." # [O]

# ─── Verification Hints (for automated reproduction) ──────
# Provide at least one hint to enable automated verification. These hints
# allow our pipeline to determine if the PoC ran successfully.
# For 'fully_automated: true', providing a reliable hint is mandatory.
#
# WARNING: 'check_command' accepts read-only query commands only.
# Any command that could alter the system state will be ignored for
# security reasons.
# ──────────────────────────────────────────────────────────
verification_hints:
  logcat_keyword: ""              # [O] A unique string printed to logcat upon success.
                                  #     e.g., "POC_SUCCESS: Credentials leaked"
  file_path_created: ""           # [O] The full path to a file created upon success.
                                  #     e.g., "/data/local/tmp/pwned.txt"
  ui_indicator: ""                # [O] A string appearing in a Toast or Notification.
                                  #     e.g., "Success: Bypassed lock screen"
  check_command: ""               # [O] A read-only command to check the final system state.
                                  #     e.g., "adb shell ls -l /data/data/com.example.vulnapp/files/"
  expected_exit_pattern: ""       # [CR] Required if 'check_command' is used. A regex pattern to
                                  #      match in the output of the check_command.
                                  #      e.g., "pwned.txt"