Cloudinary

Description

Introduction Cloudinary, a SaaS/API provider that streamlines a website's entire image management pipeline, is the market leader in providing a comprehensive cloud-based image and video management platform. Using Cloudinary you can easily move all your website’s images and other assets to the cloud. Automatically perform smart image resizing, cropping, merging, overlay, watermark, apply effects, rotations and perform format conversions. All this without installing any complex software. Simply put, if you have images in your web or mobile app, let Cloudinary manage them for you. Cloudinary offers comprehensive APIs and administration capabilities and is easy to integrate with any web application. To simplify integration further we also have client libraries for Ruby on Rails, Python/Django, PHP, .NET, Node.js and more. In addition, alternative integration methods allow non-developers, bloggers and website administrators to enjoy Cloudinary with nearly zero code changes. We truly believe that this program plays a key role in protecting our customers and their data. We appreciate all security submissions and strive to respond expediently. We are particularly interested and will consider extraordinary submissions for: Issues that result in a full compromise of a Production system (e.g, RCE, obtaining a shell back from our network) Business logic bypasses resulting in a significant impact Major operational failure (excluding Denial of Service related submissions) Please read carefully below for submission guidelines and targets

Targets

Out-of-scope targets Testing is only authorized on the targets listed as In-Scope. Any domain/property of Cloudinary not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting. Documentation: Please check out our full documentation for feature explanation, what's possible, and our API docs here: https://cloudinary.com/documentation Rules of Engagement and Submission You must use your @bugcrowdninja email address to set up your Cloudinary account. The main reason for doing so is that in case of need, our team will know you’re from Bugcrowd and have no malicious intentions. For more info regarding @bugcrowdninja email addresses, see here . Submission should include: Full description of the vulnerability being reported, including the exploitability and impact Manual step-by-step guide Additional mandatory information to support the triage processes: Videos Screenshots Exploit code Web/API requests and responses Email address or Cloud name of any test accounts For RCE submission also include: Source IP address Timestamp, including time zone Full server requests and responses Filenames of any uploaded files, which must include bugcrowd and the timestamp Call-back IP and port, if applicable Any data that was accessed, either deliberately or inadvertently Prohibited Actions & Testing: Use of automated scanners Uploading files that allow arbitrary commands (i.e webshells) Creating and maintaining a persistent connection to the server Intentionally viewing any files or data beyond what is needed to prove the vulnerability Do not test UI widgets posting feedback (“Tell us what you think” form) to https://cloudinary.com/console/api/v1/user/send_feedback Do not attack any 3rd-party supporting Cloudinary services Do not perform any testing on our support system or create any support tickets Do not perform any attack that could harm our services (e.g: DDoS/SPAM) Do not access or modify data that does not belong to you Eligibility: For a submission to be considered eligible, it should meet the following requirements: The submission must be qualified (see requirements above) The vulnerability root cause is not already known to us In & Out of scope vulnerabilities: In-Scope focused vulnerabilities: Cross-site scripting (XSS) Cross-site request forgery (CSRF) Insecure direct object references (IDOR) Injection Vulnerabilities Authentication Vulnerabilities Server-side code execution Privilege escalation Significant security misconfiguration Out of scope vulnerabilities: External SSRF - Cloudinary has built-in functionality to fetch remote URLs to read remote files into the system, via fetch URL (http://res.cloudinary.com/demo/image/fetch/), via the upload API's URL parameter https://cloudinary.com/documentation/image_upload_api_reference#upload and in other places in the API. This functionality as it's meant to be used will not be considered an SSRF vulnerability when allowing access to external servers, even though it might be used to anonymously scan other web servers for vulnerabilities or open ports other than common web ports. We will accept disclosures that show how this functionality is used to access internal networks or external services having significant security or DOS impact. Clickjacking Anything related to Mail Server Domain Misconfiguration (including email spoofing, missing DMARC, SPF/DKIM, etc.) Anything related to EXIF Geolocation data Brute Force attacks on our Login or Forgot Password pages Account lockout enforcement Internal IP address disclosure Username / Email Enumeration No Captcha / Weak Captcha / Captcha Bypass Missing HTTP security headers Cookie Issues SSL Issues Lack of rate limit Weak password policies (length, complexity, etc.) Vulnerabilities impacting only old/end-of-life browsers/plugins including: Issues that have had a patch available from the vendor for at least 6 months Issues on software that is no longer maintained (announced as unsupported/end-of-life or no patches issued in at least 6 months) Vulnerabilities primarily caused by browser/plugin defects and not representative of defects in the security of Cloudinary’s platform Previously known vulnerable libraries without working proof of concept Reports of credentials exposed by other data breaches/known credentials lists Reports of automated scanners If you have a concern about whether a potential submission is in-scope, please first validate that it is demonstrably owned by Cloudinary, and carefully read the "In & Out of scope vulnerabilities", and the "Targets" sections. If it is still unclear but you believe it should still be considered, please submit via the program, and include a few sentences describing your judgment regarding scope. Out of Scope submissions that will follow these guidelines may be considered in-scope submissions (case-by-case basis). Out of Scope submissions without reasoning and submissions that will not follow these guidelines will be marked as “Out Of Scope” with negative points. Submissions that demonstrate thoughtful consideration for scope but that we ultimately do not act on will receive a "Not Applicable" status, rather than "Out Of Scope" with negative points. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through this program, or inquire via [email protected] before going any further.