Certinia (formerly FinancialForce)

Description

No technology is perfect and Certinia believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web applications. Good luck, and happy hunting! Our team cares deeply about security, and we recognize that community-driven security research is the best way to help us keep us and our customers secure. If you have found a vulnerability in our systems, please follow the guidelines below and send it our way. Happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Testing is only authorized on the targets listed as In-Scope. Any domain/property of Certinia not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Certinia, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation.

Targets

Please read the focus areas and out-of-scope items carefully to avoid your submission from being marked as out of scope, as this may make you lose points. Focus Areas: Authentication bypass (e.g., token theft, SSO misconfiguration, etc.) RCE (Remote code execution) XSS (Cross-Site-Scripting) XXE (XML External Entity injection) SQLi (SQL injection). Open redirect. SSRF (Server-Side Request Forgery) Disclosure of sensitive information such as credentials or PII. CSRF or Clickjacking where credentials can be exfiltrated or sensitive operations can be performed (excluding login/logout) DMARC/SPF bypass with a working PoC, but only if: The issue is due to a misconfiguration on our end which can be fixed. You have only sent emails on behalf of [email protected]. You have only sent emails to the [email protected] inbox. You do not send additional exploits, tracking pixels, etc. in your email. You provide a long, unique string in your email subject (not the body), and mention this in your report so we can verify. Subdomain takeovers: Must be reported within 72hrs of the takeover Demo pages must be static and innocuous, and not hosted on the root domain (e.g., host on /takeover_poc_by_ or similar) We recommend either holding on to the takeover or taking a snapshot in Wayback Machine as proof Any other security issue with a verifiable vulnerability and tangible impact. Out-of-Scope Reports against *.salesforce.com or related Salesforce domains. PDFs under https://certinia.com that contain the string "Confidential". These files are intended to be public. Exposing "Server" HTTP header, stack traces, verbose errors, etc. without demonstrable impact Theoretical issues without demonstrating exploitability (e.g., security headers, CVEs, outdated third-party libraries, etc.). CORS misconfiguration issues unless chained with another vulnerability Denial of Service, brute force attacks , lack of rate limiting, or reporting issues that depend on these techniques. Automated scan results without providing evidence that the issue can be exploited. Self-XSS. SSL certificate or DNS configuration issues without demonstrating impact and providing a PoC. Clickjacking on pages with no sensitive actions. Unauthenticated/logout/login CSRF. Man-In-The-Middle attacks, or vulnerabilities that depend on it. Any physical attacks on Certinia property or personnel. Issues requiring access to a victim's device. Social engineering attacks (e.g., phishing, smishing, vishing, etc.). CVEs or other security advisory issues without corresponding patches. Issues with corresponding patches that are younger than 60 days. 0-day vulnerabilities less than 90 days from patch release. Vulnerabilities affecting only outdated or misconfigured browsers. Eligibility You must not be a resident of, or make your Submission from, a country against which the United States has issued export sanctions or other trade restrictions (e.g., Cuba, Iran, North Korea, Sudan and Syria, countries in OFAC-sanctioned list, etc.) Be in violation of any national, state, or local law or regulation You must be the first one to report the issue. We will also not reward you for a vulnerability we are already aware of. You must have personally discovered the vulnerability. You must not be employed by Certinia or any related entities, currently or in the last year. You must comply with this Policy when discovering the vulnerability and submitting the vulnerability report. Writing your report Reports must be provided in English (don't worry if it's not perfect English). Provide a working PoC with clear steps to reproduce the issue. We will automatically reject any theoretical or speculative issues. Provide your assessment of the impact of the issue, but avoid bloating issues with theoretical impact. Avoid reporting multiple issues in the same report, unless they are part of the same attack chain. If a single issue affects multiple systems, please raise a single, consolidated report as opposed to having a separate report for each system. If any of the above are not satisfactorily met, Certinia have the right to disqualify your submission, but may still reference what has been submitted for our further consideration. Responsible Disclosure We believe in responsible disclosure, so we ask that you: Play nice. Signs of blackmail, bribery, extortion, fraudulent activity, coercion, threats, or offensive language will not be tolerated. Avoid drip-feeding issues. For example, if you find the same vulnerability affects multiple systems, please write a combined report for all of them. Report issues as soon as possible via the Bugcrowd program. Do not publish any details of your findings until we have had a reasonable amount of time to release fixes for them. Notify us before you publish anything. Avoid accessing or modifying any sensitive information. In the event you do any of this inadvertently, contact us immediately at [email protected] providing details on what data was affected, how and when you accessed the data, and all relevant technical details. Don't worry about assessing the impact in this scenario, just report the incident ASAP. Grounds for disqualification We love a good attack chain, but we also like keeping our systems up and running, keeping our employees happy and productive, and being able to sleep at night. By doing any of the following, you may be disqualified from receiving a bounty, or in some cases, disqualified from the entire program: Withholding information about issues/drip-feeding issues. Any physical attacks on Certinia property or personnel. Performing any form of attacks on Certinia employees or contractors. Social engineering attacks (e.g., phishing, smishing, vishing, etc.). Generating large amounts of noisy traffic such as heavy web fuzzing, scanners, spiders, scrapers, form spamming, etc. Intentionally accessing, modifying or deleting sensitive information such as credentials. Attempting to perform Denial of Service or brute-force attacks. Make any configuration changes or execute state-changing commands on compromised servers (an echo is sufficient). Pivoting on issues to try to obtain access to additional internal resources. Having identified a way to obtain access to our internal infrastructure is normally sufficient. Feel free to ask us if you want to try to dig deeper and we may allow it. Compromising internal Certinia accounts. Attacks on any of our service providers or third-party integrations. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

In Scope Targets (in scope)

At Certinia we leverage AWS for our cloud infrastructure, Cloudflare for DNS, along with a good number of SaaS tools. Feel happy to report issues beyond what can be found under these domains (e.g., weaknesses based on OSINT) which may affect us. Essentially everything under the sun is in scope! Note on fuzzing and automated tools Generating large volumes of traffic (more than 5 requests per second) with fuzzers, directory brute force tools, port/vulnerability scanners, etc. is forbidden. Please configure your tools to avoid exceeding these limits.

Out of Scope (out of scope)

CVE-2021-26086 Limited Remote File Read/Include on Jira. We are aware of this issue and can confirm there is no security impact. The files exposed are all shipped with Jira out of the box.