Pin seven privilege paths to pages containing their cited headings

src/privilege-escalation-paths/azure/authorization.yaml

@@ -75,7 +75,7 @@
   service: authorization
   title: Create or update a deployIfNotExists/modify policy assignment running as an existing user-assigned identity
   source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md#policy-assignment-remediation-with-an-existing-user-assigned-identity
-  source_revision: 171e422
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   summary: The source can obtain the Azure RBAC control-plane privileges of user-assigned managed identities on which it holds assign/action, by making them the remediation identity of a policy assignment whose custom definition it controls.
   requires:
     all_of:

src/privilege-escalation-paths/azure/avs.yaml

@@ -69,7 +69,7 @@
   service: avs
   title: Gain a named vCenter identity through a verified AVS Run Command grant
   source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-vmware-solution-avs-privesc.md#run-command-identity-grants-without-reading-credentials-scriptexecutionswrite
-  source_revision: 171e422
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   summary: An AVS Run Command cmdlet can grant a named vCenter account new access only when the chosen package and cmdlet succeed and a reviewed login proves the added permission.
   requires:
     all_of:

src/privilege-escalation-paths/azure/cosmos_db.yaml

@@ -103,7 +103,7 @@
   service: cosmos_db
   title: Grant a Cosmos DB native data-plane role on the Cassandra, Gremlin, Table or MongoDB API
   source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md#same-native-rbac-self-grant-on-the-other-cosmos-apis-cassandra--gremlin--table--mongodb-account
-  source_revision: a66f094ede
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   summary: The source may grant its own Entra identity data-plane access on a matching Cosmos DB API account.
   requires:
     all_of: []

src/privilege-escalation-paths/azure/entraid_groups.yaml

@@ -145,7 +145,7 @@
   service: entraid
   title: Group owner joins an owned group
   source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md#group-owner-joins-an-owned-group
-  source_revision: 658a097d5c
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   summary: An enabled owner can join an assigned group it does not already belong to, including a role-assignable group when its protected membership requirements are met.
   requires:
     all_of:

src/privilege-escalation-paths/gcp/container.yaml

@@ -356,7 +356,7 @@
   service: container
   title: Point fleet Config Management at an attacker source to push manifests into member clusters
   source: src/pentesting-cloud/gcp-security/gcp-privilege-escalation/gcp-container-privesc.md#config-management-source-change-for-a-fleet-member
-  source_revision: 171e422
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   summary: The source may gain the Config Sync reconciler's privileges on a joined fleet-member cluster when it can change that member's Config Management source through the fleet Feature or MembershipFeature API.
   requires:
     any_of:

src/privilege-escalation-paths/gcp/workspace.yaml

@@ -47,7 +47,7 @@
   - https://docs.cloud.google.com/application-integration/docs/prepare-for-authorization-changes
   notes: The tested draft and published version paths require a collected enabled service and an observed integration in the same project and region. Other regions, new integration creation, and unattended trigger execution remain unresolved if not evidenced.
 - provider: gcp
-  source_revision: 47bb6e8f32
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   id: gcp-agentidentity-retrieve-credentials
   service: agentidentity
   title: Retrieve an authorized Google OAuth credential from Agent Identity
@@ -77,7 +77,7 @@
   - https://docs.cloud.google.com/iam/docs/reference/agentidentitycredentials/rest/v1/projects.locations.authProviders.credentials/retrieve
   notes: The client user ID is supplied by the client application and is not independently verified as a Workspace identity. The path grants only the scopes on the existing authorization and remains conditional until credential retrieval succeeds.
 - provider: gcp
-  source_revision: 47bb6e8f32
+  source_revision: 4393380a88845b42bd208d3adbb6d61ad89f02fb
   id: gcp-agentidentity-update-token-url
   service: agentidentity
   title: Change an Agent Identity auth provider's token endpoint to intercept future refreshes