Comcast Xfinity Vulnerability Disclosure Program

Description

Our Vulnerability Disclosure Program aims to encompass all the technologies, products, and services that Comcast Xfinity and Comcast Business provides. All endpoints called by these services and applications are in-scope. If you are unsure if something is owned or maintained by us, please let us know and we will make a best effort to determine if we can assist. All severities are not eligible for monetary rewards at this time. Comcast provides Xfinity Internet, TV, wireless, home automation, and more to tens of millions of residential customers, in addition to Comcast Business services to enterprise and small business customers. With so many devices and services in homes and businesses, it has never been more important to ensure the security of those products while striving to deliver an experience that is simple, elegant and powerful. With this in mind, we remain committed to working with security researchers and alongside the security community, and will maintain trust, respect, and transparency that aligns with our commitment to security and privacy. Ratings: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Comcast not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Comcast, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Out-of-Scope: OOS Comcast Subsidiaries NBCUniversal Sky OOS Submission Types: 3rd party endpoints Marketing/Analytics endpoints Server security misconfigurations with no impact (ex. Exposed instances with no sensitive data present) Email spoofing issues (e.g., SPF, DKIM, DMARC) Automated scan reports or search engine results (ie, Shodan) without valid proof of concept Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions. Comma Separated Values (CSV) injection without demonstrating a vulnerability. Open redirect - unless an additional security impact can be demonstrated. Self-Client-side injection (XSS, Angular, Vue, HTML...) and any XSS that requires Flash. Flash is disabled by default in most modern browsers, thus significantly reducing the attack surface and associated risk. CORS without exploitation. We'll accept notifications of XSS due to Swagger-UI, but they're not eligible for bounty. It will be considered as P5 Informational. Exposed credentials that are either no longer valid, or do not pose a risk to an in-scope asset. Exposure of API keys with no security impact, or where the only impact is exhausting of API quotas Vulnerabilities only affect users of outdated or unpatched browsers Descriptive error messages (e.g., Stack Traces, application, or server errors) without proof of vulnerability or risk Submissions for 3rd party code where Comcast is not responsible for the code. SSL/TLS protocol scan reports reporting purported vulnerable protocol versions or handshakes Missing best practices in Content Security Policy, HttpOnly or Secure flags on cookies. OOS Activity Types: Load Testing (DoS, DDoS, wireless jamming, etc.) Clickjacking on pages with no sensitive actions. Banner Grabbing, Scanner Outputs, Password Complexity, User Enumeration, Software version disclosure, Descriptive error messages or headers (e.g. stack traces, application or server errors) Tabnabbing. Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. Account lockout, login, or forgot password page brute force Rate limiting issues on non-authentication endpoints/Anti-Automation. Attacks requiring MITM or physical access to a user's device. Publicly accessible login panels unless proven security Impact. Any activity that could disrupt our service (DoS), including but not limited to inundating support services with invalid requests. The customer leaked credentials found in Darkweb or any OSINT tools. Social engineering attacks, including those targeting or impersonating internal employees by any means (e.g. customer service chat features, social media, personal domains, etc.) Be a current employee of Comcast or its affiliates or subsidiaries or an employee who has left Comcast or its affiliates or subsidiaries within the past 12 months. Protocol-specific flaws and open ports or services without an accompanying proof-of-concept demonstrating a vulnerability Theoretical security issues without any POC Hardware Out Of Scope Physical tampering of the device (I/O devices such as USB, SIM, and SD card slots are in scope) Submissions that require an attacker to physically open the case, including removing screws or breaking plastic casing (open chassis) to gain access to the internal hardware of a device. Vulnerabilities in pre-release product versions (e.g., Beta, Release candidate). Vulnerabilities in product versions are no longer under active support. Vulnerabilities are already known to Comcast. However, if you are the first external security researcher to identify and report a previously known vulnerability, you may still be eligible for a bounty award. Submissions that utilize third-party websites or tools for cracking or validating secrets, passwords, keys or tokens. IP address Please provide your IP address in the report while submitting the P1/P2 finding. Custom User-Agent Header Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior: X-Bug-Bounty: Rules: Do not access, impact, destroy or otherwise negatively impact any residential or business customers, or customer data in any way Do not test against any customer account without explicit permission Multiple vulnerabilities caused by one underlying issue will be awarded one bounty. Social engineering (e.g. phishing, vishing, smishing) is prohibited. When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced) including security issues that have already been identified internally. Do exercise caution when testing to avoid negative impact to data or services. Do abide by these Program Terms Do be patient & make a good faith effort to provide clarifications to any questions we may have about your submission. Do stop whenever you are unsure if your test case may cause, or have caused, destructive data or systems damage with testing a vulnerability; report your initial finding(s) and request authorization to continue testing N-Day Policy: When N-Day bugs are released to the public, we will consider these as in scope after 30 days has gone by e.g: N-day released on 01/01/2024, we would consider it in-scope on 01/31/2024 As an Internet Service Provider, technologies hosted by residential or business customers are considered out-of-scope. These can typically be identified by the FQDN format below. .hfc.comcastbusiness.net *.hsd1. .comcast.net Business/Residential Customer IP range 10.0.0.0/8 50.128.0.0/12 50.152.0.0/13 96.201.0.0/16 96.202.128.0/17 96.203.0.0/16 172.26.128.0/18 84.112.0.0/13 184.122.0.0/15 If you are unsure about a finding's eligibility, please feel free to clarify with the team by sending an email to [email protected]. Additional Information: For customers who are experiencing abuse-related issues such as phishing, spam and identity theft, the Customer Security Assurance organization has been established to respond to your issues. Their contact information can be found at our Report Abuse page We do not offer accounts or credentials for testing purposes. VRT Amendments VRT Name │ Adjusted Priority High Impact Subdomain Takeover │ P2 -> P3 If you believe a vulnerability is particularly sensitive, you may use our PGP key to encrypt your report. PGP Key: -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGBeISUBEAC0HSrden41OvU/JV6TbyZ0vCrQrx2keOsCeX0I524BrQbQP/3d YLfDCZjaq0U2ZLwV+A/Mu8O+LEqKffOqyBEVCUVyh1Zjkmkp+Jk/FomaEwGj2KYD G5iyw0j+Cuu9S1HMrKozOJCGuJ3Aq9qn38n8vLy3spsnCIiKQpJMnYBAzKwDLuO+ 2JrQ7vpZ2ytW63mLcouQ9cKmA4W5OlD6gm7Fd63KYF7g+toxHw22ZXDT01fqAA9n zIOyoLZQcLMXAfddQuRklji65/cGhtPIVsBs2ZV9xJnn50VVvfc14P22nK9bZgf0 XoeBAL8LB+f7VIVTD/+X5ToA1BiFATbivxX3dZZwzGBMxROyFpMU2RCXwZj0NItj /YfO4DnG2K77WF9XKpeqt+D/KaV9WXd91GxTJgbjY7GRsGPEjLyGqAAZAvmBdO1p +Bc2cxIiQ9yhceVfreUOdNPwp5O1p9Z8NN48cM6J1mrm4473OqIm71BoWaoh2+wn UpwPtvQ95ZFSrPrDa9MNRieGB4/zGQkDCQegOFFD1uVF477ft8I0tNUaSc/Ixwpp Gj9ijY69Ra4I66CJGtGQ79VZ1xpML8RVROTKdbh9hvqBS1/pJiGBUtiPNg5iubvS PwmLcwowA6nRU3EYj+jMmje1pEHmcgcu7oMzaWH93EdFEzl1Av4kjnC4jwARAQAB tF1Db21jYXN0IFByb2R1Y3QgU2VjdXJpdHkgSW5jaWRlbnQgUmVzcG9uc2UgVGVh bSAoUFNJUlQpIDxzZWN1cml0eWRlZmVjdHJlcG9ydGluZ0Bjb21jYXN0LmNvbT6J Ak4EEwEIADgWIQQ/lltQ7aGclNQZCAinTPOe0kWI8gUCYF4hJQIbAwULCQgHAgYV CgkICwIEFgIDAQIeAQIXgAAKCRCnTPOe0kWI8uIOD/sHfn9sMRQYlzcCntyXA/jy mgkh2IdwNxOw5wG48m771AR1VFNr54dY3AgK74xPcFsiT6FUyMKrp72weyv/7/BW vOh3M2ff9VaZjWeN/L96I3mfHkzoyQ19vDhtc9MtXnZrybV8SvWFyOO0Ziu6gNSl ygBo4GjBIkAL32uRmqcyoUZTJJdDpLAM/m76lodEQ/ekC5JmJADOdK+BmVh4rJ4H bx8Uu+SseTQ0XjccqKYu+T4OxtgqmCLc2gvLpJH72XWDU0iKOyFW1BL4rqh2RTCj rn5xEYm3RBVfHjN+z/REuyNwcxcR0dqk5h9903XsYELIQO/tHyBRGxX3HKs+R0Sk GYLe/scyoETE91DnZSPrt3c3SrwOur5E8V0yNhGbADYwD6CVVPvIZcdUjusXFdjD KT/JfSU6MCqAD70CwBTIUcEobw22C0sGQuEO5ayC3EtdbYvcoAMKU1+TyYzJFPif GeQ+KU1Q94Mnc3uh9/nTL+w54IcYm4SzkTGOYqTQPYgdnlkV+kx14iBLfI54QmZS YrfY1cqb564W8bDtis9JLRm3yJ2a2q8bCadkuSGpJ3dM6cAYXtTSQeSTiWt3L3Ri Au6i2iimUF+TxMfIxUdwRsApTOBBGIDY4EPzWSFH8+Cb3SXYBAm6Bv5KXSplnEbg v5z7jnChE2TtUDQ6LM7bF7kCDQRgXiElARAAuPg110eFje7iJ+CWF3YPYlWydzt4 3syp0tzD+FNx22eiFxJufLONxSLBjpyFcRxixsQtGF1DV/88Ois1brDBkp7kAdpd X1c+ESBmqOXTsSy6/YCeD9kChzViS6T+9qUbJLLPG0GFclOrheLumh1RrrO5XRQd j+xcF0g/3oYZrWwUFfGHg0RxFp2zi+GODK5Ab7CSsDUkZxDCbGY608Mv/hy3W5GP pIty+B/i+J4OZJ4FCzgN8jCHNMftI1vMmWFbO4dljWboDf1rNxrbYSdMTCIaSYbi Gp+K+iucGabhDjo6mCAcjMM9wn/Mo+E/WeRrqHQmYqrSMfrCU/9xZHsbMlIkK+Xj CceWmUSNMVhm22qxn6AlQUI9h2jYV4wyYw4uD4vEnkUZiGM//DWCMX6YNNFfU6f/ 4YhIuctq7cv4RHWLW3/c1zHJsNq8r6uaTdYEtYBYWQvYvNj9/aNkuDnjA/TMHEH/ amND500m8HOEs7X6nHLsai/9ZpxUuAlgq+4UVKOX+qG5P+SDbeSUJEqBaCfbC8zE SQ5ngSro5et+bOsiC59JfwA/iRlSL5IfJpThIHMoI7SPWvwlQxBwLlfkiDBv0k0e w5uw07VDc32WVWg9OIMMwUL5NeMoX535Y6WEZYDPRSTMVy3doUcze+bdWnwzPLbd e/DyWjjHzoCwh00AEQEAAYkCNgQYAQgAIBYhBD+WW1DtoZyU1BkICKdM857SRYjy BQJgXiElAhsMAAoJEKdM857SRYjy/ZcP/AgQ611ciptmamHlYcwq3EsRTa050UN/ 9/Tw8KzPG5zRIrfgfJKJ90GMOtrAxGCj4Ysbm+oJpRB+M59TOBI+aFw+k4TO4LCq oaFPPHwLN9pg0Rg5nYnqm0rzCQHYC5iZYbTGnb5GxBW5wLCe+WtkUVLnoEShNEJU +Atqs5V34ZmpfzsEqCRlg9vJhodnpwZpYv5iGlqSEL4llfgRfga5P9VKBwjPCklx A3A6AXOxXDj1g1mR5DDOfE74aOIS6sB+jN7Fe4wBdF+SCgtuiOk0fr+D8xbMkGRy OrsUZZLnu534YreoUGxFnPp4svNp7HFnb1qCUnNdnDwPyeNsL1TKN3C6dqieNlbw og60fXUIZ5knYHiHm5BSEfzgVoHrykzq9DUT/fa9xLAxP381chLGTU9jSRDPIPeY 7YuLDh0pgCqoqQO/QkzsJPE8JyBke7iLFviczlhh31nH9V4dn23c3G5EWgyL3n5u S2lEuH14ieCh3Ql4lKD/hNhYEr3DTvrM3OKOgsGFKB+KMmorsT9ePWs2J6gA4dMA MQbCp6sSvxSM/lGKCZSgyRsuuWoWKRTqT7MhIhmea3AbyG5rzqLqw+aMGRiY3Uuc 6OwtW8m2ieGl4AyTUvfsIg+iE+al8FXAEFoN2rxtUFZvc8elpvSe6qkLxEAaSt3O g6h+SklSCYsx =Lfos -----END PGP PUBLIC KEY BLOCK-----