Cisco ThousandEyes Vulnerability Hunting aka Bug Bounty

Description

Cisco ThousandEyes enables organizations to see and take action to maintain and optimize every digital journey that matters. From application experience to hop-by-hop network path and performance, Cisco ThousandEyes provides end-to-end visibility from every user to any application over any network. Now, you can maximize the value of your digital investments and leverage them to drive differentiation in the market. No technology is perfect, and ThousandEyes believes that working with skilled security researchers worldwide is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher and help us identify vulnerabilities in our targets. Good luck, and happy hunting! Important Guidelines: (Must Read) Please ensure that the string " Bugcrowd- " is appended to your user agent for all HTTP/HTTPS traffic before performing any testing. Example instructions on how to modify the user agent string for Chrome can be found here , and for Burp Suite can be found here . Automated vulnerability scans are strictly prohibited (this includes any brute-force enumeration). Maintaining confidentiality regarding any vulnerabilities you discover between ThousandEyes and yourself is crucial. – See the Legal Information below . At any point as a researcher, you are not allowed to modify/test any existing customer data or download any information other than from the Trial account or ThousandEyes grant to which you have been given access. – See the Legal Information below . It's strictly forbidden to conduct any form of Denial of Service testing. If you identify a vector by which DoS can be performed, please get in touch with [email protected] or submit a submission write-up. Please note that as a bug bounty program participant, you play a crucial role in maintaining the security and availability of this live production environment. This is a Private Program, so you must refrain from discussing program details, including Program name, scope, Vulnerability details, bounty structure, account information, or any other detail to anyone who is not a Bugcrowd employee or member of this Program. When collaborating with other Finders on the Program, do so securely, per the disclosure requirements listed in Bugcrowd's Code of Conduct . Please clearly follow account creation guidelines for testing, including account naming and email conventions. Your submission may only be accepted if you adhere to those guidelines. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases, a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher, and the opportunity to appeal and make a case for a higher priority.

Targets

Any domain/property of ThousandEyes not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Target Information (In-Scope for Reward): app.thousandeyes.com —This is our web application platform, a core component of ThousandEyes SaaS that Customers use to create network performance monitoring tests, alerts, and reports. www.thousandeyes.com —This is our company website. It provides information about our services, allows new users to create accounts, and directs existing users to the web application platform. api.thousandeyes.com —This is our customer-accessible API. It allows programmatic interaction with the web application platform. ThousandEyes Enterprise Agent (Linux) - The ThousandEyes platform uses agents to run tests against targets configured for measurement. An agent is a Linux server running custom ThousandEyes software, which checks in with an agent collector to obtain instructions from the ThousandEyes platform. More information ThousandEyes Endpoint Agent (Windows) - The ThousandEyes Endpoint Agent is an application installed on user endpoint machines to collect network- and application-layer performance data when users access specific websites from monitored networks. More information Other than the above, everything else is considered out of scope. Additional details on what is out of scope are below on this page. Accessing the offerings: To register for an account, please go here . Please sign up for an account using your @bugcrowdninja.com email address (see here for more info regarding @bugcrowdninja.com emails https://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address ). If you don't use your @bugcrowdninja address, your account will not be accepted, and you may be IP banned if you proceed to test Use Bugcrowd for the First, Last, and Company name fields. This will forward a request to our team, and your account will be activated within one business day. A new organization will be created for you, and the account used to sign up will permit you to be an Organization Admin. You can also make other users with lower-level privileges - researchers are encouraged to create other users to test vertical privilege escalation issues, etc. Useful links(Documentation): API Documentation*: Here Developer Documentation*: Here Getting Started with ThousandEyes*: Here Role-Based Access Control*: Here Agent Types*: Here What is an Enterprise Agent? Working with Agent settings*: Here Firewall configuration for Enterprise agents*: Here Getting started with Endpoint Agent*: Here How to set up the Virtual appliance*: Here Working with the dashboard*: Here Working with Test settings*: Here Working with Alerts*: Here Working with Reports*: Here Any other useful links can be accessed by searching on this page*: Here Focus Areas: IDOR (Insecure Direct Object Reference) Authentication Bypass Authentication Related Issues Local Privilege Escalation Cross-Account Access Incorrect Permissions Data Exposure Remote Code Execution SQL Injection (SQLi) Command Injection Local File Inclusion Remote File Inclusion Directory Traversal Cross-Site Scripting (XSS) OWASP Top 10 Out-of-Scope/Prohibited Activities and Vulnerabilities: This program is designed to review and address security issues related to Cisco ThousandEyes. Please note that anything not explicitly listed as in-scope is considered out-of-scope. You must not exploit, investigate, or target vulnerabilities against vendors used by ThousandEyes to provide the ThousandEyes offering, for example, you must not exploit, investigate, or target vulnerabilities against Amazon Web Services’ infrastructure. If you believe you have found a vulnerability that is outside of this program's scope but related to Cisco, please refer to the resources below: If you need to report a vulnerability in a Cisco product, please contact [email protected]. If you need to contact Cisco regarding a security incident, please contact [email protected]. Cisco Systems Operational Infrastructure findings can be reported here: https://bugcrowd.com/ciscosecurity Further information can be found here: https://www.cisco.com/security The support subdomain at ThousandEyes should not be tested in any shape or form . This includes but is not limited to: Starting a chat within the application, including sharelinks Interacting with the ThousandEyes community via https://app.thousandeyes.com/sfdc/community Opening support tickets via email Leaked credentials from 3rd parties This includes credential dumps found on websites, leaked credentials from indirect sources other than ThousandEyes, etc. Manual crafting/ manual generation of malicious Agent traffic Do NOT attempt to send manually crafted or altered Agent traffic to the ThousandEyes application. Vulnerabilities that occur through test settings configured in the ThousandEyes web application are valid vectors for attack . Vulnerabilities that involve manually (‘manual’ includes tools like Burp Intruder, ZAP, python scripts, etc.) sending traffic to the Agent data ingress points or controllers (c1.thousandeyes.com, eb.thousandeyes.com, etc.) are not valid vectors for attack . Edited binaries do not qualify as valid findings If a vulnerability relies on the generation or use of a binary created by someone other than ThousandEyes, it will not be considered for this campaign. Registration of Agents into Other Accounts Do not register Enterprise or Endpoint Agents into other ThousandEyes user accounts. Do not report the registration of an Agent into another account as a vulnerability. Prohibited Tools and Methods. Do not use any tools or methods that have the potential to automatically generate volumes of traffic that may be considered a Denial of Service (DoS) event or in any way may impact our delivery of products and services. No Social Engineering. Do not use any social engineering (e.g., phishing, vishing, smishing) methods concerning this Program. Findings that rely on social engineering to exploit (such as XSS links accessed from outside the application) will not be considered valid findings. In short, if your vulnerability requires an attacker to engage in Social Engineering, it will not be considered valid UNLESS the link is sent from the ThousandEyes application. Destroying Data and Interference with Services and Systems. Do not destroy data or interruption or degradation related, either directly or indirectly, to our services and systems. Your research must be performed to view, capture, change, divert, or otherwise compromise any data that is not yours. No Data Access Permitted. You are not permitted to intentionally view, capture, change, disclose, retain, or otherwise interact with any data, including ThousandEyes data or ThousandEyes’s customer data, that is not directly related to a Vulnerability subject to this Program. If you discover a Vulnerability that allows you to access the data of anyone else, including any ThousandEyes data or ThousandEyes’s customer data, immediately cease accessing such data upon detection of such Vulnerability and promptly notify ThousandEyes so we can promptly secure that data. See the Legal Information below. Personal Data Access Prohibited. You are not permitted to intentionally view, capture, change, disclose, control, process, or otherwise interact with any Personal Data concerning this Program. “Personal Data” means any information relating to an identifiable individual (also called Personally Identifiable Data). If you gain access to Personal Data, please immediately cease the activities giving rise to that access and promptly notify ThousandEyes so we can promptly secure that data. Do not identify names of individuals or ThousandEyes customers in your Reports. Do not include unnecessary information in your submission to investigate your Reports. Accessing other Accounts Prohibited. When investigating a Vulnerability, please only target your account. Never intentionally attempt to access anyone else's data, and do not engage in any activity that would damage ThousandEyes, its customers, partner community, employees, or others. Automated Vulnerability Scanning. Please note that using automated vulnerability scanning tools like Nuclei or Nessus is strictly prohibited in our program. Additionally, Turbo Intruder is permitted ONLY to test unique functionality that only Turbo Intruder can find. Ensure you are only limiting this to 15 requests. If there's abuse, you will be removed from the program. Prohibited Activities All of the following activities are prohibited: Vulnerabilities resulting from violations of Program Policy and terms. Vulnerabilities not directly impacting ThousandEyes. Clickjacking on pages with no sensitive actions. Cross-site request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions. Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Comma Separated Values (CSV) injection without demonstrating a Vulnerability. Missing best practices in SSL/TLS configuration. Any activity that could lead to the disruption or denial of our service (DoS). If you are unsure about such a possible disruption, please get in touch with [email protected] before proceeding. Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. Rate limiting or brute force issues on non-authentication endpoints. Missing best practices in Content Security Policy. Missing HttpOnly or Secure flags on cookies. Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.). Vulnerabilities only affecting users of outdated or unpatched browsers [Less than two stable versions behind the latest released stable version]. Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g., stack traces, application or server errors). Public Zero-day vulnerabilities that have had an official patch for less than one month will be awarded on a case-by-case basis. Tabnabbing. Open redirect - unless an additional security impact can be demonstrated. Issues that require unlikely user interaction. Missing CSP (Content Security Policy) Configuration Vulnerabilities reported by automated tools (e.g., Burp Suite) CORS Issue without a working POC Presence of Auto-complete attribute on Web forms Reports about weak password policy Username E-mail enumeration via forgot password Server version disclosure Findings from applications or systems not listed in the Targets section Functional UI/UX bugs and spelling mistakes Defacing any site or resource. Report if you think you can do it and how, but don’t do it Under the Thousand Eyes' Customer Success Community (https://success.thousandeyes.com/PublicFeedItemContent), any actions that are initiated from the "Ideas" tab, including: Creating a new idea Commenting on an existing idea Upvoting an existing idea Downvoting an existing idea Known Issues, ThousandEyes Web Application: 30 May 2024 User-defined hyperlinks can be inserted into signup welcome emails. This has been assessed as a Low-Risk issue. API Access for documentation account (e.g., one can use the credentials provided in the official documentation to perform authenticated API requests) Lack of ‘adequate’ Content Security Policy on all domains There is a lack of sufficient Automation Protection on the Forgot Password form (e.g., the form can be used to send spam). Overly permissive CORS Policy (on all domains) Account lockout logic - e.g., one can successfully enumerate valid account IDs via the lockout feature. The user ID is displayed in cookies Cookies and Request Headers Multiple concurrent sessions allowed Lack of maximum session length for any application interface (or ‘Agent’ interface) Known Issues, ThousandEyes Enterprise Agent: Any package-based vulnerabilities in the downloadable ‘Enterprise Agent’ images that are not sourced from or directly imposed by the ThousandEyes ‘Agent’ software (this includes all operating system patches and CIS hardening controls) Certain ‘Agent’ interfaces may report a lack of clickjacking defense HTTPS is not strictly enforced on Enterprise Agents The HTTPS web app on the appliance site lacks Strict Transport Security Session Cookie not set with ‘Secure’ flag in the ‘Admin’ interface of the Virtual Appliance Agents do not require approval to register to the ThousandEyes platform Appliance-based ‘Agents’ contain known SSH CVEs labeled as ‘no-patch,’ i.e., “Will Not Fix” by Canonical Self-signed HTTPS hosts are by design. Customers can upgrade certs as required A lack of ‘SECCOMP’ or similar controls for hardening container-based agent activities CIS compliance violations of any ‘Agent’ type are treated as ‘known’ (not in scope) Any ‘binary analysis’ (e.g., detection of allegedly vulnerable versions in raw strings) based findings on any downloadable ‘Agent’ artifact are not in scope A lack of ‘required password complexity’ for the administrative HTTPS user The default user/pass combination for the ‘Agent’ HTTPS interface is not strong enough Known Issues, ThousandEyes Endpoint Agents: Any ‘CVE’ based detections that appear to be disclosed by ‘binary analysis,’ or related processes (not in scope) Any ‘compile-time’ detections, including ‘security build-time options’ for any ThousandEyes installer or executable, are not in scope The ‘Endpoint Agent’ runs as SYSTEM on Windows operating systems The ‘Endpoint Agent’ is built uniquely per customer endpoint by the ThousandEyes application; as such, any identifying characteristics based on hashing or similar measures are not in scope Any findings that are related to associated libraries being executed ‘only in secured environments’ are not considered to be in scope Detections based on ‘certificates’ or ‘signatures’ regardless of the certificate authority or operating system provider, are not considered to be in scope Legal Information In addition to these Terms and Conditions regarding the Cisco ThousandEyes Program, there may be additional restrictions depending upon applicable local laws. The parties to this Agreement are you and ThousandEyes. "ThousandEyes" refers to ThousandEyes LLC. By participating in the Program, investigating a potential vulnerability, or submitting a vulnerability, you affirm that you have not disclosed and agree that you will not disclose the vulnerability to anyone other than ThousandEyes. Absent ThousandEyes 's prior written consent, any disclosure outside of this process would violate this Agreement. You agree that money damages may not be a sufficient remedy for a breach of this paragraph by you and that ThousandEyes will be entitled to specific performance as a remedy for any such breach. Such remedy will not be deemed to be the exclusive remedy for any such breach but will be in addition to all other remedies available at law or equity to ThousandEyes. By submitting information about a potential vulnerability, you are granting ThousandEyes a worldwide, royalty-free, non-exclusive license to use your submission for the purpose of addressing vulnerabilities in ThousandEyes’ products and services. In the event of substantially duplicate submissions, ThousandEyes may at its discretion provide a reward only for the earliest received submission. Eligibility for rewards, determination of the recipients, and amount of reward is at the discretion of ThousandEyes. If issues reported to our bug bounty program affect a third party or another vendor, ThousandEyes reserves the right to forward details of the issue along to the party without further discussion with the researcher. You are responsible for all taxes associated with and imposed on any reward you may receive from ThousandEyes. You may only exploit, investigate, or target vulnerabilities against your own accounts and/or your own devices. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours; intentional access of customer data other than your own is prohibited. If you inadvertently access proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, or recorded in any way. In the event of inadvertent access to such data, you must delete such data immediately and notify ThousandEyes of such inadvertent access within your submission. Your testing activities must not negatively impact ThousandEyes, ThousandEyes’ products or services generally, or ThousandEyes’ online environment availability or performance. ThousandEyes may choose not to remediate at its sole discretion. This Agreement constitutes the entire agreement of the parties with respect to the items listed above. This Agreement is covered by California law. This Agreement may be amended or modified only by a subsequent agreement in writing. If any portion of this Agreement is found to be illegal or unenforceable, then the parties will be relieved of their responsibilities arising under such portion, but only to the extent that such portion is illegal or unenforceable. You must not be the author of the code with the vulnerability. You must not be an employee or contractor of ThousandEyes or its affiliates, or a family member of an employee or contractor. THOUSANDEYES RESERVES THE RIGHT TO MODIFY OR CANCEL THIS PROGRAM AT ANY TIME WITHOUT NOTICE. ALL PARTICIPANTS AND SUBMISSIONS ARE STRICTLY VOLUNTARY. THIS OFFER IS VOID WHERE PROHIBITED BY LAW AND IN PARTICIPATING, YOU MUST NOT VIOLATE ANY LAW. YOU ALSO MUST NOT DISRUPT ANY SERVICE OR COMPROMISE ANYONE’S DATA.