Avisi Marketplace Bug Bounty Program

Description

This bounty is part of the Atlassian Marketplace Bug Bounty Program Avisi is committed to security and appreciates the efforts of security researchers. By collaborating through this bug bounty engagement, we aim to strengthen the security of our Atlassian Marketplace applications. Thank you in advance for your contributions! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher, along with the opportunity to appeal and make a case for a higher priority. Rewards will be distributed once for a set of vulnerabilities sharing the same root cause. If multiple endpoints are affected, please group them into a single submission.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Avisi not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but demonstrably belongs to Avisi you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Focus Areas Below is a list of some of the vulnerability classes that we are seeking reports for: Cross Instance Data Leakage/Access (Unauthorized data access between instances) Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues Credentials: Researchers should use the "bugbounty-test-.atlassian.net" namespace provided in the instructions below. Please do not create additional instances outside of this namespace for testing. Creating Your Instance JIRA + Confluence Cloud To access the instance and start your testing (after you've read and understood the scope and exclusions listed below, of course) you can follow the below steps: Navigate to the signup page and complete the sign up by email process here Click "Agree" Complete the form, using the following format: bugbounty-test- Note that should be replaced with your own bugcrowd username Click "Start now" Once your instance has been completed that's it - you can test away. Proceed to the application's marketplace listing and install the respective application. There is a tab for installation instructions should you need guidance. Server and Data Center Sign up pages: https://www.atlassian.com/software/jira/download https://www.atlassian.com/software/jira/download/data-center https://www.atlassian.com/software/confluence/download https://www.atlassian.com/software/confluence/download/data-center To access the instance and start your testing (after you've read and understood the scope and exclusions listed below, of course) you can follow the below steps: Navigate to the signup page and complete the signup process by email here Select the release you would like to use and click "Get Started" -Agree to the terms and conditions and click "Submit" Follow the rest of the installation instructions Once your instance has been completed that's it - you can test away. Proceed to the application's marketplace listing and install the respective application. There is a tab for installation instructions should you need guidance. N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025 Excluded Submission Types P5 Vulnerabilities Clickjacking or issues exploitable only through clickjacking. CSRF on forms available to anonymous users (e.g., contact forms). Username/email enumeration. Cache-Control and Pragma issues. Local access-required XSS (e.g., User-Agent Header injection), unless demonstrably exploitable through off-path MitM attacks. Known library vulnerabilities or outdated third-party library reports, unless proven exploitable. Source code disclosure. Non-confidential information disclosure (e.g., issue/project IDs, commit hashes). Out-of-Scope Volumetric attacks e.g.: DoS/DDoS/Network DoS Rate limiting Email bombing/flooding etc. Upload/download malicious files to the platform Blind XSS must not return any user data that you do not have access to (e.g. Screenshots, cookies that aren't owned by you, etc). Please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your web server, etc). If injecting on any form that may be publicly visible such as forums, etc. Before injection, please make sure your payload can be removed from the site. If it cannot be easily removed, please check with Bugcrowd Support before performing the testing. Pivoting or post-exploitation attacks (i.e. using a vulnerability to find another vulnerability) Customer cloud instances and data are explicitly out of scope. Automated scanners Rules You must ensure that customer data is not affected in any way as a result of your testing. Please ensure you're being non-destructive whilst testing and are only testing on instances that you own. In addition to the above, customer instances are not to be accessed in any way (i.e. no customer data is accessed, and customer credentials are not to be used or "verified") If you believe you have found sensitive customer data (e.g., login credentials, API keys, etc) or a way to access customer data (i.e. through a vulnerability) report it, but do not attempt to successfully validate if/that it works. Use of any automated tools/scanners is strictly prohibited and will lead to you being removed from the program (trust us, we have those tools too). Reports need to be submitted in plain text (associated pictures/videos are fine as long as they're in standard formats). Non-plain text reports (e.g. PDF, DOCX) will be asked to be resubmitted in plain text. Grants/awards are at the discretion of Avisi and we withhold the right to grant, modify or deny grants. But we'll be fair about it. Tax implications of any payouts are the sole responsibility of the reporter. Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure. Do NOT test the physical security of Avisi offices, employees, equipment, etc. This bounty follows Bugcrowd’s standard disclosure terms. Public Disclosure Before disclosing an issue publicly we require that you first request permission from us. Avisi will process requests for public disclosure on a per-report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without Avisi written consent will have any allocated bounty withdrawn and disqualified from the program. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.