Autodesk

Autodesk is dedicated to ensuring the security of our products and services. We welcome the security community’s contributions to help safeguard Autodesk and customer data. This policy outlines how vulnerabilities can be reported and how Autodesk handles submissions.

Table of Content

1. Response Targets
2. Our Process
3. Program Rules
4. Priority
5. Scope
6. Program Exclusion
7. Eligibility
8. Disclosure
9. Rewards
10. Safe Harbor

Response Targets

Autodesk targets the following SLAs for researchers participating in our program:

You will receive updates throughout the resolution process.

Our Process

1. Submission: Researchers submit reports via HackerOne, providing:

• Detailed reproduction steps
• Proof-of-concept code or screenshots, where applicable

2. Validation: Autodesk’s Product Security Incident Response Team (PSIRT) or HackerOne will validate and assess the vulnerability.
3. Tracking: If multiple systems are impacted, include all affected systems in the report.
4. Recognition: Duplicate reports will be marked accordingly, but the first valid submission will receive recognition.

Program Rules

To ensure efficient and ethical testing, researchers must adhere to the following rules:

1. Employees of Autodesk and their immediate family members are not eligible to participate.
2. Social engineering tactics (e.g. phishing, vishing, smishing) are strictly prohibited.
3. Avoid privacy violations, destruction of data, or service interruption or degradation. Only test with accounts you own or have legal authorization to use and in compliance with the Autodesk Terms of Use.
4. Do not use high volume scanners or automated testing tools, as these may be flagged as malicious and result in suspension of your account or banning your IP address.
5. Do not publicly disclose vulnerabilities identified in the Autodesk VDP program until Autodesk has remediated the vulnerability and validated that the remediation was successful.
6. Ensure your testing does not negatively impact other users or systems.

User Data Handling

7. Do not access data beyond what is necessary to demonstrate the vulnerability. Whenever possible, please use methods that demonstrate vulnerabilities without exposing personal data.
8. In the course of testing or reporting, researchers may encounter limited user data such as usernames, profile images, or email addresses. If you encounter this or other user data, report the issue to help us assess the impact. In some situations, user data may be visible to other users based on our services' design (for example, see the "Is the personal data you give us ever displayed publicly?" section of Autodesk's Privacy Statement and "Your Content" section of our Terms of Use) and as such, may not qualify for researcher rewards.

Priority

We prioritize vulnerabilities based on their severity, impact, and exploitability. Specifically, we focus on:

• Critical and high-severity vulnerabilities that impact confidentiality, integrity or availability of offerings or data stored in them.
• Common security risks, including:
  • Remote Code Execution
  • SQL Injection
  • Buffer Overflows
  • Cross Site Scripting (XSS) in sensitive contexts
  • Authentication Bypasses
  • OWASP Top 10 Vulnerabilities
• Lower-severity vulnerabilities, while appreciated, may receive lower prioritization.

Scope

Autodesk welcomes report of vulnerabilities affecting any Autodesk-owned system, application, or service. This includes but is not limited to:

• Web applications
• Desktop and mobile applications
• API and cloud services

All public-facing assets directly owned by Autodesk are open for testing under this policy. However, some assets are considered out-of-scope, including:

• Third-party sites that reference Autodesk branding but are not owned or operated by Autodesk (e.g., partner or reseller websites). Vulnerabilities in such third-party sites should be reported to the respective third-party.
• Versions of desktop applications that are either not officially supported or do not have the latest patch versions installed. For information about deprecated versions, please visit Autodesk available product versions. Patches are delivered through Autodesk Access or available for download on the Autodesk Accounts Portal.
• Some assets are considered out-of-scope for this program due to their association with third-party services, staging environments, or non-production endpoints. Please refer to the Out-of-Scope Asset List for the most current set of URLs, APIs and domains that should not be targeted. This list may be updated independently of this policy.

Important: Please do not target any of the assets listed in the Out-of-Scope Asset List as part of your security testing activities.

Program Exclusions

The following reports or activities will not be accepted:

• Denial of service attacks (including DoS, DDoS).
• Spamming or flooding systems with automated requests.
• Physical attack against Autodesk properties, data centers, or facilities.
• Reports from web crawlers or archivers such as URLs in Wayback Machine.

Eligibility

To ensure effective collaboration, researchers must:

• Notify us promptly upon discovering a potential vulnerability to allow timely resolution.
• Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or third-party.
• Follow Autodesk’s and HackerOne's disclosure guidelines when reporting vulnerabilities.
• Submit detailed, reproducible reports, including proof-of-concept if applicable.
• Limit reports to one vulnerability unless multiple issues must be reported together to demonstrate impact.
• Proof-of-Concept (PoC) submissions must be designed to simulate impact without causing real damage. Malicious or destructive payloads are not permitted and will disqualify the submission.

Disclosure

Autodesk is committed to working with researchers to responsibly disclose reported vulnerabilities. For the protection of our customers, we request that researchers refrain from disclosing vulnerabilities until fixes are available and any potentially affected customers are notified.

Autodesk is a registered CNA (CVE Numbering Authority) and may issue a CVE (Common Vulnerabilities and Exposures) if a vulnerability is confirmed to be in scope, meets Autodesk criteria, and is ready for public disclosure or release. This criteria includes, but is not limited to:

• The vulnerability is within scope of Autodesk products or services and does not belong to a third party or another registered CNA.
• The vulnerability is not publicly known or is not confidential.
• The vulnerability requires user interaction to patch or remediate.

All CVEs issued will be posted on the Autodesk Trust Center as part of a Security Advisory as well as published to the National Vulnerability Database (NVD). Autodesk will work with the researcher to ensure that their work is acknowledged as part of the advisory.

Rewards

Submissions to Autodesk’s VDP are not eligible for monetary rewards. However, researchers will receive acknowledgement for their contributions. Additionally, in select cases, swag items may be provided as a token of appreciation for outstanding efforts. Researchers also gain reputation points within the HackerOne platform for valid submissions.

Gold Standard Safe Harbor

Autodesk supports the protection of organizations and hackers engaged in Good Faith Security Research. “Good Faith Security Research” is accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs or those who use such devices, machines, or online services. We consider Good Faith Security Research to be authorized activity that is protected from adversarial legal action by us. We waive any relevant restriction in our Terms of Use(“TOU”) and/or Acceptable Use Policies (“AUP”) that conflicts with the standard for Good Faith Security Research outlined here. This means that for Good Faith Security Research conducted with a good faith effort to comply with our program policy and while this program is active, we: Will not bring legal action against you or report you, including for bypassing technological measures we use to protect the applications in scope; and, Will take steps to make known that you conducted Good Faith Security Research if someone else brings legal action against you. You should contact us for clarification before engaging in conduct that you think may be inconsistent with Good Faith Security Research or unaddressed by our policy. Keep in mind that we are not able to authorize security research on third-party infrastructure, and a third party is not bound by this safe harbor statement.

Thank you for helping keep Autodesk and our users safe!