Comcast Xfinity Bug Bounty

Description

Welcome to the Xfinity Bug Bounty program! This program will be trialing our first comprehensive paid rewards program for the products that shape the Xfinity consumer experience. We're offering higher-paying rewards in more categories to an exclusive group of researchers. We are excited for you to help us identify vulnerabilities in our applications and grow our bug bounty program. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority and reward will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. Note the following amendments for this program: VRT Name │ Adjusted Priority High Impact Subdomain Takeover │ P2 -> P3 Basic Subdomain Takeover │ P3 -> P4

Targets

Target Information: Comcast provides Xfinity Internet, TV, wireless, home automation, and more to tens of millions of residential customers. With so many devices and services in homes, it has never been more important to ensure the security of those products while striving to deliver an experience that is simple, elegant, and powerful. With this in mind, we remain committed to working with security researchers and alongside the security community, and will maintain trust, respect, and transparency that aligns with our commitment to security and privacy. Credentials: We do not offer accounts or credentials for testing purposes. IP address Please provide your IP address in the report while submitting the P1/P2 finding. Custom User-Agent Header Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Out-of-Scope: OOS Comcast Subsidiaries NBCUniversal Sky OOS Submission Types: 3rd party endpoints Marketing/Analytics endpoints Server security misconfigurations with no impact (ex. Exposed instances with no sensitive data present) Email spoofing issues (e.g., SPF, DKIM, DMARC) Automated scan reports or search engine results (ie, Shodan) without valid proof of concept Clickjacking on pages with no sensitive actions. Banner Grabbing, Scanner Outputs, Password Complexity, User Enumeration, Software version disclosure, Descriptive error messages or headers (e.g. stack traces, application or server errors) Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions. Comma Separated Values (CSV) injection without demonstrating a vulnerability. Any activity that could disrupt our service (DoS), including but not limited to inundating support services with invalid requests. Self-Client-side injection (XSS, Angular, Vue, HTML...) and any XSS that requires Flash. Flash is disabled by default in most modern browsers, thus significantly reducing the attack surface and associated risk. CORS without exploitation. We'll accept notifications of XSS due to Swagger-UI, but they're not eligible for bounty. It will be considered as P5 Informational. The customer leaked credentials found in Darkweb or any OSINT tools. Vulnerabilities only affect users of outdated or unpatched browsers Exposed credentials that are either no longer valid, or do not pose a risk to an in-scope asset. Rate limiting issues on non-authentication endpoints/Anti-Automation. Exposure of API keys with no security impact, or where the only impact is exhausting of API quotas Protocol-specific flaws and open ports or services without an accompanying proof-of-concept demonstrating a vulnerability SSL/TLS protocol scan reports reporting purported vulnerable protocol versions or handshakes Missing best practices in Content Security Policy, HttpOnly or Secure flags on cookies. Open redirect - unless an additional security impact can be demonstrated. Theoretical security issues without any POC OOS Activity Types: Load Testing (DoS, DDoS, wireless jamming, etc.) Attacks requiring MITM or physical access to a user's device. Tabnabbing. Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. Account lockout, login, or forgot password page brute force Publicly accessible login panels unless proven security Impact. Social engineering attacks, including those targeting or impersonating internal employees by any means (e.g. customer service chat features, social media, personal domains, etc.) Descriptive error messages (e.g., Stack Traces, application, or server errors) without proof of vulnerability or risk Submissions for 3rd party code where Comcast is not responsible for the code. Be a current employee of Comcast or its affiliates or subsidiaries or an employee who has left Comcast or its affiliates or subsidiaries within the past 12 months. If you are unsure about a finding's eligibility please feel free to clarify with the team by sending an email to [email protected]. Hardware Out Of Scope Hardware submissions can be submitted on the Xfinity Home program. Rules: Do not access, impact, destroy or otherwise negatively impact any residential or business customers, or customer data in any way Do not test against any customer account without explicit permission Multiple vulnerabilities caused by one underlying issue will be awarded one bounty. Social engineering (e.g. phishing, vishing, smishing) is prohibited. When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced) including security issues that have already been identified internally. Do exercise caution when testing to avoid negative impact to data or services. Do abide by these Program Terms Do be patient & make a good faith effort to provide clarifications to any questions we may have about your submission. Do stop whenever you are unsure if your test case may cause, or have caused, destructive data or systems damage with testing a vulnerability; report your initial finding(s) and request authorization to continue testing N-Day Policy: When N-Day bugs are released to the public, we will consider these as in scope after 30 days has gone by e.g: N-day released on 01/01/2024, we would consider it in-scope on 01/31/2024 If you believe a vulnerability is particularly sensitive, you may use our PGP key to encrypt your report. PGP Key: -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGBeISUBEAC0HSrden41OvU/JV6TbyZ0vCrQrx2keOsCeX0I524BrQbQP/3d YLfDCZjaq0U2ZLwV+A/Mu8O+LEqKffOqyBEVCUVyh1Zjkmkp+Jk/FomaEwGj2KYD G5iyw0j+Cuu9S1HMrKozOJCGuJ3Aq9qn38n8vLy3spsnCIiKQpJMnYBAzKwDLuO+ 2JrQ7vpZ2ytW63mLcouQ9cKmA4W5OlD6gm7Fd63KYF7g+toxHw22ZXDT01fqAA9n zIOyoLZQcLMXAfddQuRklji65/cGhtPIVsBs2ZV9xJnn50VVvfc14P22nK9bZgf0 XoeBAL8LB+f7VIVTD/+X5ToA1BiFATbivxX3dZZwzGBMxROyFpMU2RCXwZj0NItj /YfO4DnG2K77WF9XKpeqt+D/KaV9WXd91GxTJgbjY7GRsGPEjLyGqAAZAvmBdO1p +Bc2cxIiQ9yhceVfreUOdNPwp5O1p9Z8NN48cM6J1mrm4473OqIm71BoWaoh2+wn UpwPtvQ95ZFSrPrDa9MNRieGB4/zGQkDCQegOFFD1uVF477ft8I0tNUaSc/Ixwpp Gj9ijY69Ra4I66CJGtGQ79VZ1xpML8RVROTKdbh9hvqBS1/pJiGBUtiPNg5iubvS PwmLcwowA6nRU3EYj+jMmje1pEHmcgcu7oMzaWH93EdFEzl1Av4kjnC4jwARAQAB tF1Db21jYXN0IFByb2R1Y3QgU2VjdXJpdHkgSW5jaWRlbnQgUmVzcG9uc2UgVGVh bSAoUFNJUlQpIDxzZWN1cml0eWRlZmVjdHJlcG9ydGluZ0Bjb21jYXN0LmNvbT6J Ak4EEwEIADgWIQQ/lltQ7aGclNQZCAinTPOe0kWI8gUCYF4hJQIbAwULCQgHAgYV CgkICwIEFgIDAQIeAQIXgAAKCRCnTPOe0kWI8uIOD/sHfn9sMRQYlzcCntyXA/jy mgkh2IdwNxOw5wG48m771AR1VFNr54dY3AgK74xPcFsiT6FUyMKrp72weyv/7/BW vOh3M2ff9VaZjWeN/L96I3mfHkzoyQ19vDhtc9MtXnZrybV8SvWFyOO0Ziu6gNSl ygBo4GjBIkAL32uRmqcyoUZTJJdDpLAM/m76lodEQ/ekC5JmJADOdK+BmVh4rJ4H bx8Uu+SseTQ0XjccqKYu+T4OxtgqmCLc2gvLpJH72XWDU0iKOyFW1BL4rqh2RTCj rn5xEYm3RBVfHjN+z/REuyNwcxcR0dqk5h9903XsYELIQO/tHyBRGxX3HKs+R0Sk GYLe/scyoETE91DnZSPrt3c3SrwOur5E8V0yNhGbADYwD6CVVPvIZcdUjusXFdjD KT/JfSU6MCqAD70CwBTIUcEobw22C0sGQuEO5ayC3EtdbYvcoAMKU1+TyYzJFPif GeQ+KU1Q94Mnc3uh9/nTL+w54IcYm4SzkTGOYqTQPYgdnlkV+kx14iBLfI54QmZS YrfY1cqb564W8bDtis9JLRm3yJ2a2q8bCadkuSGpJ3dM6cAYXtTSQeSTiWt3L3Ri Au6i2iimUF+TxMfIxUdwRsApTOBBGIDY4EPzWSFH8+Cb3SXYBAm6Bv5KXSplnEbg v5z7jnChE2TtUDQ6LM7bF7kCDQRgXiElARAAuPg110eFje7iJ+CWF3YPYlWydzt4 3syp0tzD+FNx22eiFxJufLONxSLBjpyFcRxixsQtGF1DV/88Ois1brDBkp7kAdpd X1c+ESBmqOXTsSy6/YCeD9kChzViS6T+9qUbJLLPG0GFclOrheLumh1RrrO5XRQd j+xcF0g/3oYZrWwUFfGHg0RxFp2zi+GODK5Ab7CSsDUkZxDCbGY608Mv/hy3W5GP pIty+B/i+J4OZJ4FCzgN8jCHNMftI1vMmWFbO4dljWboDf1rNxrbYSdMTCIaSYbi Gp+K+iucGabhDjo6mCAcjMM9wn/Mo+E/WeRrqHQmYqrSMfrCU/9xZHsbMlIkK+Xj CceWmUSNMVhm22qxn6AlQUI9h2jYV4wyYw4uD4vEnkUZiGM//DWCMX6YNNFfU6f/ 4YhIuctq7cv4RHWLW3/c1zHJsNq8r6uaTdYEtYBYWQvYvNj9/aNkuDnjA/TMHEH/ amND500m8HOEs7X6nHLsai/9ZpxUuAlgq+4UVKOX+qG5P+SDbeSUJEqBaCfbC8zE SQ5ngSro5et+bOsiC59JfwA/iRlSL5IfJpThIHMoI7SPWvwlQxBwLlfkiDBv0k0e w5uw07VDc32WVWg9OIMMwUL5NeMoX535Y6WEZYDPRSTMVy3doUcze+bdWnwzPLbd e/DyWjjHzoCwh00AEQEAAYkCNgQYAQgAIBYhBD+WW1DtoZyU1BkICKdM857SRYjy BQJgXiElAhsMAAoJEKdM857SRYjy/ZcP/AgQ611ciptmamHlYcwq3EsRTa050UN/ 9/Tw8KzPG5zRIrfgfJKJ90GMOtrAxGCj4Ysbm+oJpRB+M59TOBI+aFw+k4TO4LCq oaFPPHwLN9pg0Rg5nYnqm0rzCQHYC5iZYbTGnb5GxBW5wLCe+WtkUVLnoEShNEJU +Atqs5V34ZmpfzsEqCRlg9vJhodnpwZpYv5iGlqSEL4llfgRfga5P9VKBwjPCklx A3A6AXOxXDj1g1mR5DDOfE74aOIS6sB+jN7Fe4wBdF+SCgtuiOk0fr+D8xbMkGRy OrsUZZLnu534YreoUGxFnPp4svNp7HFnb1qCUnNdnDwPyeNsL1TKN3C6dqieNlbw og60fXUIZ5knYHiHm5BSEfzgVoHrykzq9DUT/fa9xLAxP381chLGTU9jSRDPIPeY 7YuLDh0pgCqoqQO/QkzsJPE8JyBke7iLFviczlhh31nH9V4dn23c3G5EWgyL3n5u S2lEuH14ieCh3Ql4lKD/hNhYEr3DTvrM3OKOgsGFKB+KMmorsT9ePWs2J6gA4dMA MQbCp6sSvxSM/lGKCZSgyRsuuWoWKRTqT7MhIhmea3AbyG5rzqLqw+aMGRiY3Uuc 6OwtW8m2ieGl4AyTUvfsIg+iE+al8FXAEFoN2rxtUFZvc8elpvSe6qkLxEAaSt3O g6h+SklSCYsx =Lfos -----END PGP PUBLIC KEY BLOCK----- Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

███████████████ (in scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

█████████████████ (in scope)

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████ (out of scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████