ALD Pro (Astra Linux Directory Pro)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz High / top band (no critical tier exists for this programme); floor RUB 50,000 │ RUB 100,000 │ RUB 100,000 Medium; floor RUB 25,000 │ RUB 50,000 │ RUB 50,000 Low; floor RUB 10,000 │ RUB 25,000 │ RUB 25,000 Submit a vulnerability Latest advisories Loading the feed Overview ALD Pro is the domain directory suite for Astra Linux estates — the product that does what Active Directory does on the other side of the fence — and the reason it is listed here is that the programme's own rules say what it is made of. Verbatim, the product "является деривативом… программного обеспечения с открытым исходным кодом", and the rules then name the components: FreeIPA, 389 Directory Server, MIT Kerberos KDC, BIND 9, Chrony, Reprepro, Samba, CUPS, ISC DHCP, TFTP-HPA, syslog-ng, Zabbix and SaltStack. The ALD Pro distribution wrapped around them is proprietary to RusBITech-Astra, but the surface a researcher actually attacks is that GPL, LGPL and BSD-family stack as integrated, and a defect in the directory or Kerberos layer of a domain controller is domain-wide compromise rather than a single-host problem. BI.ZONE prices it on a plain three-band severity axis published through its public unauthenticated API: RUB 10,000 to 25,000 at Low, RUB 25,000 to 50,000 at Medium and RUB 50,000 to 100,000 at High, with no critical tier defined above them. The programme is built around novelty — a known CVE only counts if it was published no more than thirty days before the research VM image went up, and that image is ALD Pro 3.2.1, posted 2026-06-26. sorona.xyz adds 1.25× on top of whatever BI.ZONE awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope What the programme's own rules declare: ALD Pro "является деривативом… программного обеспечения с открытым исходным кодом", and the rules then name the components it derives from. Those components as integrated and shipped in the product are the target: FreeIPA, 389 Directory Server, MIT Kerberos KDC, Samba, BIND 9, Chrony, ISC DHCP, TFTP-HPA, CUPS, syslog-ng, Zabbix, SaltStack and Reprepro Everything a domain controller runs as installed, since that host is where those components are wired together and where the product's own integration and management layer sits on top of them The directory and authentication core: LDAP handling in 389 DS, ticket issue and validation in the MIT KDC, and the FreeIPA management framework with its web interface and its API Domain services reachable across the network from a host that has no credentials yet: DNS through BIND 9, address assignment through ISC DHCP, network boot through TFTP-HPA, printing through CUPS and file sharing through Samba The SaltStack-based configuration and orchestration path, which by design executes instructions from the domain controller on every joined machine Client-side enrolment and the agent software running on joined hosts, plus monitoring through Zabbix, log handling through syslog-ng and time synchronisation through Chrony Package distribution through Reprepro, the path by which an ALD Pro estate receives its software updates All of the above as shipped in ALD Pro 3.2.1, the version distributed as the programme's research VM image and its defined testing target Out of scope Any expectation of a critical band: the grid defines Low, Medium and High only, and nothing is priced above RUB 100,000 Known CVEs published more than thirty days before the research VM image went up, which the rules place outside the reward entirely Astra Linux Special Edition itself, which BI.ZONE runs as a separate programme against its own proprietary mandatory-access-control and closed-software-environment mechanisms Anything you cannot demonstrate on the supplied research VM image, since that image is the programme's defined testing target Scope detail beyond the published component list, which sits behind the platform's login and must be confirmed inside an account rather than assumed from this page Most-valued findings Authentication bypass or privilege escalation to domain administrator through the FreeIPA, 389 DS and MIT KDC layer: the High band, the only one that reaches RUB 100,000, and the finding that hands over every account and every joined host at once Kerberos ticket forgery or validation failure in the KDC, which turns a single defect into the ability to impersonate any principal in the domain Command execution through the SaltStack orchestration path, where a compromised or spoofed master reaches every minion by design and one bug becomes fleet-wide code execution Pre-authentication network-reachable defects in the domain services a client contacts before it has any credentials, DNS, DHCP, TFTP boot and Samba, which are attackable from any position on the network Novel bugs rather than rediscoveries: the thirty-day rule against the VM image date means the programme pays for what is not yet in the CVE record, so reading the integration seams between these components is worth more here than scanning for known versions Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Known-CVE reports are only eligible if the CVE was published no more than thirty days before the research VM image was posted, so the programme is buying novel bugs in that open-source stack rather than rediscoveries Testing runs against the supplied research VM image, ALD Pro 3.2.1, published 2026-06-26, rather than against anyone's live domain The ladder tops out at High: no critical tier is defined for this programme, so RUB 100,000 is the ceiling and not a band on the way to a bigger one Rewards are published and paid in roubles, and are shown here unconverted because that is the currency the programme actually prices in The programme hall sits behind a login and a CAPTCHA, so register and read the full scope and terms inside an account before you start work File with BI.ZONE before you send the finding anywhere else, and hold the detail until the programme confirms you are clear to publish Disclosure Coordinated through BI.ZONE, which takes the report and passes it to the vendor. Hold the detail until the programme confirms a fix has shipped and you are clear to publish. The full terms sit behind the platform's login, so read them inside your account before you publish anything. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability