Bug Bounty Program - BlaBlaCar

Rules

#Bug Bounty Program - BlaBlaCar

##About the company

BlaBlaCar is the world's leading community-based travel network enabling over 100 million active members per year to share a ride across 21 countries.

Our technology fills empty seats on the road, connecting members looking to carpool or to travel by bus, making travel more affordable, sociable, and convenient.

##Reporting & Disclosure Policy

BlaBlaCar believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our products or services, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
• If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded accordingly to your findings.
• No vulnerability disclosure, full, partial or otherwise, is allowed without explicit approval.
• Denial of service (DoS) attacks on {{BU_NAME}} applications, servers, networks or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic
• Do not leak, copy, manipulate, or destroy any user data or files in any of our applications/servers.

##Reward Eligibility

We are happy to thank everyone who submits valid reports which help us improve the security of BlaBlaCar, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and BlaBlaCar, and remediation advice on fixing the vulnerability
  • Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact
  • Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
• You must not break any of the testing policy rules listed above
• You must not be a former or current employee of BlaBlaCar or one of its contractors.

Reward amounts are based on:

• Reward grid of the report's scope
• CVSS scoring and actual business impact of the vulnerability upon performing risk analysis

##Scopes of the program

In general BlaBlaCar and BlaBlaCar Daily websites and apps are part of this bug bounty. Please refer to the detailed list of scope if you have a doubt.

However, though listed in the out-of-scope list, if you really feel that a bug will leave an impact on our platform, please come up with a convincing and working POC. If that convinces us to change our code, we will reward you with a bounty.

Out of scope

• Any website that is not listed explicitly in the scope.
• However, though listed in the out-of-scope list, if you really feel that a bug will leave an impact on our platform, please come up with a convincing and working POC. If that convinces us to change our code, we will reward you with a bounty.
• Finally, fraud related reports are out-of-scope if they do not exploit a security vulnerability. Therefore, fraud activity enabled by bug or incomplete business rules enforcement are out-of-scope. However, a fraud activity enabled by a CSRF exploit for example is valid.

Qualifying vulnerabilities

• SQL Injection (SQLi)
• Cross-Site Scripting (XSS)
• Remote Code Execution (RCE)
• Insecure Direct Object Reference (IDOR)
• Horizontal and vertical privilege escalation
• Authentication bypass & broken authentication
• Business Logic Errors vulnerability with real security impact
• Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
• Cross-Origin Resource Sharing (CORS) with real security impact
• Cross-site Request Forgery (CSRF) with real security impact
• Open Redirect
• Exposed secrets, credentials or sensitive information on an asset under our control and affecting at least one of our scopes

Non-qualifying vulnerabilities

• Reports without an accompanying proof-of-concept demonstrating vulnerability and security impact
• Security best practices without a real security impact
• Reports with attack scenarios requiring physical access to victim or social engineering attempts
• Reports that are theoretically possible but NOT having tangible exploits, evidence of similar kinds
• Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
• Recently disclosed 0-day vulnerabilities
• Tabnabbing
• Self-XSS or XSS that cannot be used to impact other users
• Low severity Cross-Site Request Forgery (CSRF) (e.g. Unauthenticated / Logout ...)
• "HTTP Host Header" XSS
• Missing cookie flags
• Missing security-related HTTP headers which do not lead directly to an exploitable vulnerability and PoC
• Mixed content warnings
• Clickjacking/UI redressing
• Lack of rate-limiting, brute-forcing or captcha issues
• CVEs without exploitable vulnerabilities and PoC
• Open ports or services without exploitable vulnerabilities and PoC
• Logout and other instances of low-severity Cross-Site Request Forgery
• Content spoofing without embedding an external link or JavaScript
• Denial of Service (DoS) attacks
• SSL/TLS issues (e.g. expired certificates, best practices)
• Missing HTTP Strict Transport Security Header (HSTS)
• Invalid or missing email security records (e.g. SPF, DKIM, DMARC)
• Password reset token leak on trusted third-party website via Referer header (eg Google Analytics, Facebook…)
• Presence of autocomplete attribute on web forms
• Protocol mismatch
• Blind SSRF without exploitable vulnerabilities and PoC (e.g. DNS & HTTP pingback, Wordpress XMLRPC)
• Crashing your own application
• Vulnerable/outdated software/libraries without demonstrable attack vector and PoC
• Finding your numeric user id in integer format instead of UUID4 or encrypted format
• Disclosure of information without exploitable vulnerabilities and PoC (e.g. stack traces, path disclosure, directory listings, software versions, IP disclosure, 3rd party secrets, EXIF Metadata, Origin IP)
• Session management issues (e.g. lack of expiration, no logout on password change, concurrent sessions)
• Issues that require physical access to a victim’s computer/device
• Reports with attack scenarios requiring MITM or physical access to victim's device
• Weak password policies (e.g. length, complexity, reuse)
• Pre-account takeover (e.g. account creation via oAuth)
• Any vulnerability on a Github repository that is "Archived"
• Ability to spam users (email / SMS / direct messages flooding)
• Vulnerabilities involving stolen credentials or physical access to a device
• Vulnerabilities affecting outdated browsers or mobile binaries - only exploits working on latest browser versions of Safari, FireFox, Chrome, Edge, IE and the versions of our application that are currently in the app stores will be accepted
• Lack of SSL Pining/ binary protection/ code obfuscation / jailbreak and root detection / anti-debugging controls/ etc
• Exploiting a generic Android or iOS vulnerability
• Lack of encryption on internal databases/preference files on mobile device
• Finding security issues on the iOS / Android apps in a non standard usage case (jailbroken/rooted phone, making backups, ...)
• Message moderation bypass
• Non-mandatory email validation at signup
• API client ID/Secret embedded in client app (web, Android, iOS)
• Disclosed or misconfigured public API keys (e.g. Google Maps, Firebase, analytics tools...)