Blend Labs

Blend Labs looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

Response Targets

Blend Labs will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

• Please follow HackerOne's disclosure guidelines.

Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. *Intended functionality does not qualify for reward. Prior to submitting a report, please refer to the latter sections of his document titles "Ineligible Vulnerabilities", "Security Findings vs. Intended Functionality", and "Security Findings v.s. Development Functionality".

Test Plan

Program Details

Blend's responsible disclosure and bug bounty program's focus is on protecting and maintaining the data and its integrity of lenders and borrowers who use our systems. Our Blend platform makes it easy for borrowers to apply for loan products from any desktop, tablet, or mobile device. While enabling our lenders to work in parallel and follow up instantly with additional requests and information.

Since the Blend platform must collect, manage, and protect sensitive user data, such as PII and imported bank account data, we strive to ensure that the platform is as secure as possible. As such, we value (and reward) the responsible disclosure of any vulnerabilities to us.

For the initial prioritization/rating of findings, this program will use the Hacker1 Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.

Disclosure Policy

Follow HackerOne's disclosure guidelines.

Scope

In-Scope Targets

https://knox.beta.blendlabs.com

Out of scope targets

https://blend.com/

Any *.blend.com or *.blendlabs.com subdomains.

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Blend not listed in the targets section is out of scope. This includes any/all subdomains not listed above. The same applies to vulnerabilities found in any 3rd party services Blend integrates with and does not own.

If you believe you've identified a vulnerability on a system outside the scope, please reach out to Hacker1's support team before submitting it.

Background Information

The Blend platform is composed of a ReactJS/Express.js front-end and Express.js microservices connected to various backend databases. The ReactJS/Express.js front-end contains both a lender view, which allows lenders to manage loans in the system, and a borrower view, which allows borrowers to complete a mortgage loan application. Lender accounts can only be created by an authorized Admin, but borrower accounts can either be created through self-registration or an invitation email.

Focus Areas

All of the following issues especially if originating from a borrower account (e.g. privilege escalation to a lender from a borrower account, another borrower's sensitive user data from a borrower account, etc.) are of particular interest to us.

• Authentication bypass or elevation of privileges
  • Vertical (e.g. obtain lender privilege from borrower account or admin privilege from lender account)
  • Horizontal (e.g. obtain other borrower sessions from one borrower session or lender-lender)
• Sensitive data exposure (e.g. unauthorized disclosure of loan information or other sensitive user data)
• "root" access to the underlying server(s)
• Multitenancy exploits
  • Multiple tenants exist within the pentest environment
  • Exposing data or access from one tenant to another

Ineligible Vulnerabilities

• Social Engineering or Phishing attacks against Blend employees or Blend's customers
• Brute-force DDoS or resource exhaustive attacks
• Attacks making use of MITM techniques, DNS spoofing, or physical access to a Blend-owned asset
• Best practice reports without valid exploits such as weak TLS cipher suites
• Self-XSS
• Outdated or vulnerable libraries without exploit proof of concept
• Lender to Lender IDOR (Please read below for information regarding "Security Findings vs. Intended Functionality")

Security Findings vs. Intended Functionality

The relationship between a lender and a borrower is unique in that lenders are privy to a great deal of sensitive financial information relating to a borrower. Furthermore, lenders within a single organization may need access to the data of the borrowers under other lenders within the same organization. What might initially appear to be a security finding of inappropriate data disclosure may actually be intended functionality when it comes to a lender's access to borrower data.

Security Findings v.s. Development Functionality

Blend beta environments contain several development tools to aid in creating test loans for specific cases. Findings that involve development-specific features will also not be considered valid. For example, if a vulnerability is disclosed that makes use of our "Fast Forward" or "Dev tools" functionality to create test loans, the finding will not be considered valid unless the exploit can be carried out without the use of the development tools.

Access

• Create a borrower account by going to the target and clicking Sign Up.
• Create a lender account: Please fill out the form https://forms.gle/YnxBXKDu48hYg21RA and credentials will be created and sent to you promptly
• The Blend platform allows you to connect to third-party bank accounts. Use these credentials to test the behavior.
  • Bank account credentials (Please select Bank of America):
    • user/pass: blend_test
    • Two Factor Auth: 1234
  • SSN:
    • any 9-digit number.

Scanning

Scanning is not permitted since the Blend platform is hosted behind an AWS ELB (AWS policy).

Extra Notes

The "Receives notifications about unassigned loans" role option will generate a lot of emails towards any user with that role assigned. If you are interested in testing the functionality of this option, enable the option for a non-Admin role (preferably a newly created role) and assign a user/email address to that role.

Safe Harbor:

When conducting vulnerability research according to this policy, we consider this research to be:

• Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
• Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
• Exempt from restrictions in our Terms ; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.
• You are expected, as always, to comply with all applicable laws.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

Rewards

Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Blend Labs.

[Instructions: When rewards section is completed, remove it from here and place it into product]

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Clickjacking on pages with no sensitive actions
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Rate limiting or bruteforce issues on non-authentication endpoints
• Missing best practices in Content Security Policy.
• Missing HttpOnly or Secure flags on cookies
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
• Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
• Tabnabbing
• Open redirect - unless an additional security impact can be demonstrated
• Issues that require unlikely user interaction
• Google Maps API Token Exposure
• Rate Limiting on Password Reset
• Hard Coded Password (Fast123!)

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Blend Labs and our users safe!