Aiven Managed Bug Bounty

Description

Aiven is a next-generation managed cloud database platform as a service. Its focus is in ease of adoption, high fault resilience, customer's peace of mind and advanced features at competitive price points. See https://aiven.io/ for more information. No technology is perfect, and Aiven believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. We will not accept issues that have been previously reported to Aiven through other channels, regardless if whether they have not yet been reported within the Bugcrowd platform.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Aiven not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Aiven, you can report it. However, be aware that it is ineligible for rewards or points-based compensation. Making the Most of our Program We strongly recommend focusing on our managed database applications Vulnerabilities in our website are frequently reported and have a high number of duplicates, whereas most issues reported with our managed database applications are unique. For a demonstration of how to create managed databases in Aiven, please see this quick video . If you want to automate things, we provide a spectrum of DevOps tools and interfaces to make this easy . The security of our customers' data from cross-account access and the security of our hosts and our orchestration plane are among Aiven's top priorities; reports of demonstrated security problems impacting these priorities are particularly valuable to Aiven. You are welcome to use our free tier services and trial credits to use the managed database services. If your account needs additional trial credits beyond the base initial amount, we are happy to grant some free of charge to support legitimate testing activity; please reach out through the program. If your vulnerability report is based on the version of running software, please attempt a proof of concept on an Aiven system first. We have mitigated many issues that arise from hosting our services in a public cloud environment, and the software we are running may differ from upstream, so for example a CVE against a particular version of Postgres may not be exploitable on Aiven even if we are running the version to which it applies. Aiven's Permission Model Aiven expects that, regardless of what might be shown in the web console: Permissions that are granted in the API are intentionally granted, whether or not they are "greyed out" or accessible in the console; however, access that is granted to resources with which the attacker has no relationship at all is likely a bug. Users who are allowed to access the service user (usually avnadmin) are intentionally granted access to all of the service functionality, regardless of whether the Aiven API allows particular operations that influence the service configuration. Program Rules Only use your @bugcrowdninja email addresses for registering testing accounts. Do not use any other email addresses such as @gmail.com for security testing. Only interact with accounts and services you own or with explicit permission of the account holder. Specifically, take note of rules on aivencloud.com domain. Only use Aiven services via the Aiven brand. Using our services through our business partners' interfaces is out of scope . Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Social engineering (e.g. phishing, vishing, smishing) is prohibited. You are testing on production. Behavior that compromises the stability and integrity of the site is out of scope. For example, do not target other users' data (instead, please use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS or DDoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it. Exploit Chain Testing The focus of the program is initial access vectors. We are interested in your exploration of the following chained goals, to demonstrate severity: Credential theft . If you find a credential, please report it (you may include the credential in your report). We will determine the scope of access of the credential; please do not attempt to discover the scope of access yourself, as you will create needless alerts and we will shut all your services off. Access to internal network services . Look specifically for internal services to which you can gain substantial access. Mere network scanning or open ports are not sufficient to demonstrate impact; at minimum, positively identify the type of service to which you can pivot. Cross-account access . We are interested in avenues to make authenticated access to other accounts' services where the other account has not allowed this access - please use only other accounts that you own, not random customers. As these types of exploitation frequently trigger alarms, we request that you report what you have found as soon as possible. We will rate such vulnerabilities according to the access that the initial access vector provides. Report Guidelines We are interested in real-world vulnerabilities that have material security impact. Theoretical vulnerabilities without a proof of concept are not eligible for reward. The proof of concept has to be specific to (and work on) the Aiven domain or resource your report is about. Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, there will be unnecessary delays in processing the issue. Report quality is taken into account when making decisions about reward and disclosure. Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. Do not submit any attachments unless requested by our team. Screenshots are accepted, but videos, binaries and so on are not okay. Applications within the scope of this engagement share the same codebase. Vulnerability reports submitted on the same vulnerability across different endpoints belonging to Aiven are not eligible for multiple rewards. Multiple reports on the same vulnerability will be considered duplicates. Please submit a single report. Reports of software versions with known vulnerabilities (e.g. CVE) found on our domains must have a working proof of concept, or they will be marked spam. Vulnerabilities that are not exploitable as deployed on an in-scope domain or service are out of scope. Please also note that Aiven monitors dependency versions and it is highly likely we are already internally tracking these issues, and so they are likely to be marked as duplicates if they do not disclose any threat beyond direct exploitation of the known vulnerability. Do not submit scanner output. In general, automated tools and scanners won't provide you much help, because we run them ourselves already. If your report consists only of pasted scanner output, we will mark it spam. While we do not prohibit the use of AI tooling to help write vulnerability reports, we greatly value conciseness and rigour. We also request that you check your findings and reproduction yourself to avoid false positives. Reports that are excessively long due to generated text are likely to experience delayed triage, and repeated submission of generated false positives may result in a ban. You may not automate submission of vulnerabilities to this program; there must be a human in the loop. We will pay a P4 bounty for issues that are limited to misleading documentation and do not require code changes to fix, or issues resulting in customer confusion about a security feature that only require changes to explanatory strings and elements in user interface layers, as long as the confusion results in a likely security impact. Duplicative Reports We want every valid vulnerability discovered by the public to get exactly one bounty. Therefore, we do not support bounty strategies that involve reporting the same issue to dozens of programs rapid-fire in an attempt to get paid for the same issue by many programs. Issues that are more appropriately the responsibility of another entity may be forwarded to them and may not receive a bounty. For example, if you find an issue that impacts Grafana in general, we expect you to report it to Grafana Labs, not to the bug bounty program of us and every other Grafana customer. We appreciate your commitment to getting security vulnerabilities fixed. To avoid this issue, we recommend concentrating on issues that relate to how Aiven sets up and manages our customers' services, rather than issues with the services in general. If you could copy the report from somewhere else and paste it into the submission form for our program unchanged, it will most likely be rejected. Similar Targets Bugs that apply in essentially the same way against the following targets are considered one bug, not two. When equivalent services are in scope for which bugs are presumptively equivalent, we will note those services here. Access All targets are accessible through the public internet. Credentials To gain access to the application, please sign up for a free trial account using your @bugcrowdninja.com email address in any of the targets listed In Scope. For more info regarding @bugcrowdninja email addresses, see here . We request that you not create credentials using other email domains. For example, if you invite another user, that user should be of the form "[email protected]". In particular, please do not use disposable email addresses. General Information You may create instances of any of our public services to test against within your account. You must create the account using your bugcrowdninja.com email address and should only interact with services in aivencloud.com that you created and control. The services can be launched via https://console.aiven.io/ or using our API at https://api.aiven.io/ (documentation at https://api.aiven.io/doc/ ). We provide a brief overview of our services here, but the most up to date information will be available at https://docs.aiven.io/ . Information about Billable Services You may use a free tier account, or you may use trial credits; if you require additional trial credits, please reach out within the program with a description of your activity, and some can be added to your account. Please do not use a credit card; expenses will not be reimbursed in case you are billed, and removing your card from our system will take some time . Focus Areas Aiven is particularly concerned with the following threats: Cross-client data access Total control of another customer's account Pivot attacks within Aiven's orchestration plane Remote code execution on services not designed to provide this Out of Scope Only services you create by yourself - for example, PostgreSQL, Kafka and Grafana - are in-scope. Other services in aivencloud.com domain not created by you are explicitly out of scope, as those are our customers' services. Functionality provided through third parties is out of scope. This includes Calendly, Qualified, Salesforce, and similar. In general, functionality like contact us forms, scheduling and booking, interactions with our sales team, and real-time chat functionality will be provided through third parties; before submitting, check whether the domain you are interacting with is hosted by Aiven or a third party. The contact us form (https://aiven.io/contact) and embedded versions of this contact us form on other pages are out of scope. You can identify and ignore them based on the src of the iframe (https://go.aiven.io/l/890043/2022-02-15/7dc33?referrer=contact or similar). Rate limiting issues Unreported or very recently reported issues (0day), or issues for which no patch is available, against software not published by Aiven. The patch must have been out for at least 30 days and new services created in Aiven must be vulnerable for us to pay a bounty for a known public issue. For example, an issue in Postgres that was reported publicly only last week will not be eligible for a bounty from our program. Also note that when such issues are eligible for a bounty, it may be at a reduced rate. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

Database Services Tier 1 (in scope)

Aiven for Clickhouse See https://aiven.io/clickhouse for details about the service. Aiven for ClickHouse is powered by ClickHouse, a highly scalable, open source database that uses a column-oriented structure. ClickHouse is designed for online analytical processing (OLAP) applications, and is an ideal tool for applications such as web analytics, or complex data reporting. Aiven for Metrics See https://aiven.io/docs/products/metrics/concepts/metrics-overview for details about the service. Aiven for Metrics is a managed service that provides a Prometheus service for storing and querying service metrics information. It is essentially an implementation of Thanos. Aiven for Valkey See https://aiven.io/valkey for details about the service. Aiven for Valkey is an in-memory database using the open-source project https://valkey.io/ . It is often used for queueing and caching, and is an alternative to Redis. Aiven for Apache Kafka See https://aiven.io/kafka for details about the service. Also in scope are Aiven for Apache Kafka Connect https://aiven.io/kafka-connect and Aiven for Apache Kafka MirrorMaker 2 https://aiven.io/mirrormaker . These services can be added to a Kafka service in your account. Aiven for Apache Kafka® is a fully managed streaming platform, deployable in the cloud of your choice. Snap it into your existing workflows with the click of a button, automate away the mundane tasks, and focus on building your core apps. Aiven offers a REST API for Kafka governance which is within the scope of this bounty tier. See https://aiven.io/docs/products/kafka/concepts/governance-overview for more information.

Database Services Tier 2 (in scope)

Aiven for PostgreSQL See https://aiven.io/postgresql for details about the service. Aiven for PostgreSQL is a fully managed SQL database, deployable in the cloud of your choice. Snap it into your existing workflows with the click of a button, automate away the mundane tasks, and focus on building your core apps. Aiven for MySQL See https://aiven.io/mysql for details about the service. Aiven for MySQL is a fully managed SQL database, deployable in the cloud of your choice. Snap it into your existing workflows with the click of a button, automate away the mundane tasks, and focus on building your core apps. Aiven for OpenSearch See https://aiven.io/opensearch for details about the service. Aiven for OpenSearch is a fully managed search and analytics suite forked from Elasticsearch, and deployable in the cloud of your choice. Note that Aiven for OpenSearch has two access control models for customers to select from. It is possible to manage security through the Aiven Console, or through OpenSearch native security management. The models are distinct, and in some cases it may be possible for users making either choice to configure OpenSearch in ways that might not be allowed in the Aiven console. Using option 1, access control on the Aiven console, it is intentionally possible that developers having the avnadmin user can make any change to the service. See https://aiven.io/docs/products/opensearch/concepts/access_control for more information. Note: Using the access control feature, ACLs apply only to indices and do not control access to other OpenSearch APIs, including OpenSearch Dashboards. Aiven for Grafana See https://aiven.io/grafana for details about the service. Aiven for Grafana is a fully managed analytics and monitoring solution, deployable in the cloud of your choice. Snap it into your existing workflows with the click of a button, automate away the mundane tasks, and focus on building your core apps. Regatta Regatta is an internal application at Aiven. The Okta system is out of scope; however, we are interested in anything that demonstrably grants unauthorized access to the application. Please do not report cookie or header related issues or other "best practice" items unless you can demonstrate unauthorized access.

In Scope (Website Console) (in scope)

Target Information Please be aware of the following two key points regarding console.aiven.io , to avoid spending your time on an informational or unreproducible submission: API operations invoked by the console are authenticated using the aivenv1 token in the Authorization: header, not the browser cookies; if you copy the authorization header from a request made by a user, the operation will be performed as that user and this is not a bug. The primary purpose of the Aiven console is for our customers to administer their services with us. Users can, and nearly all users do, grant credentials and access to services that they create to principals that may not even have a user in the Aiven console. Note also that https://aiven.io is hosted by fly.io. We are aware that fly.io has a network configuration that makes some scanners claim ports are open which are not. Also, vulnerabilities that would affect any fly.io site should be reported to fly.io and not to this program. We are particularly interested only in those vulnerabilities in https://aiven.io that can affect https://console.aiven.io or https://api.aiven.io, or that allow for defacement or code injection into https://aiven.io.

Aiven Open Source Repositories (in scope)

Vulnerabilities in Aiven open source code. If a repository is forked from another repository, and the vulnerability is also present in the repository it's forked from, it is not eligible for a bounty; we recommend submitting to upstream.

Capture the Flag Challenge (in scope)

Include in your report the following items: The complete contents of /etc/ssh/ssh_host_ed25519_key , i.e. the server's SSH host private ed25519 key, current as at the time of exploitation The current external IP address of the host An explanation of how you got the key Please do not submit the server's public key or your own machine's SSH private key.

Out of Scope (out of scope)

In general, services hosted for Aiven by third parties are out of scope. Aiven's test environment is also out of scope. This group provides a partial list of targets for which reports will not be accepted by our program. Most subdomains of Aiven that are not specifically marked in scope are hosted by a third party. Please check who is hosting the service, if possible, before submitting your bug. Services created by customers are generally within the aivencloud.com domain. If you did not create the service, and it is not specifically identified here as a challenge target, you may not perform testing against it. We suggest creating a service within your own account to perform this testing.

Third-Party Dependency Versions (in scope)

For this group, refer to the rest of the brief for in-scope assets and limitations. We limit the total payout for reports that show only that Aiven exposes a vulnerability in a third-party dependency. Do not use this tier for vulnerabilities that are primarily due to Aiven's code or deployment model. Be aware that Aiven conducts software composition analysis internally and reports of this type may be duplicates of internal findings.

Aiven Runtime (out of scope)

Aiven Runtime is an application development platform for containerized applications that run alongside databases. Read about it at https://aiven.io/docs/products/runtime. Runtime is not yet in scope for the bug bounty program. We will update this page when it is.