Dell Technologies Application Bug Bounty

Description

Dell Technologies ("Dell") recognizes the value of the security community to create a more secure world and welcomes the opportunity to collaborate with community members who share this common goal. This bug bounty program (the “Bug Bounty Program”) is limited to those security vulnerabilities identified within the dell.com and delltechnologies.com pages listed as in scope the Targets section below. Please carefully review inclusions and exclusions detailed in the sections below. Note: All other Dell products, applications and online properties are excluded from this Bug Bounty Program. Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher. Please see below for any exceptions from the standard VRT. Dell does not accept or make payment for reports of stolen or compromised credentials that are sourced from sanctioned entities, sanctioned individuals, or sanctioned locations. Dell will request affirmation from the researcher that the credentials were not obtained through a source to which the researcher paid money or other consideration. For submissions regarding GitHub Credentials, all findings will be initially rated as a P5. Once the finding has been determined to have a real impact, it will be upgraded accordingly. Remember, it is beneficial to include the sensitive information in your finding along with the link to help speed up the validation process. Vulnerabilities in Dell websites and services not explicitly out of scope or explicitly in scope of this program will be rated as a P5. Reporting Requirements When reporting an issue to this program, please be sure to include the following: The description, VRT, Target, and Bug URL fields should all be filled in. Detailed replication steps (how to replicate this issue - in a step by step manner that could be followed by even non security-involved persons) A real-world exploit scenario (elaborate on WHAT an attacker could do with this vulnerability, and HOW they would go about doing so - please do not deal in extreme hypotheticals - e.g. those that would require the intervention of a nation-state, etc) When testing functionality using forums or other public-facing areas, please ensure that any dummy data you create, or control is removed once testing is complete. This helps maintain the integrity of our system.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Dell not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please submit to this program. These types of findings will be initially triaged as a P5 informational only. Target Information Web Applications All URLs listed in the In scope Targets section above are publicly accessible web applications. Researchers are invited to test all aspects of these applications. Please use a custom HTTP header in all your traffic while testing. Identifier │ Format │ Example Username │ X-Bug-Bounty: Bugcrowd- │ X-Bug-Bounty:Bugcrowd-MDell Checkout Process Testing The focus of this Bug Bounty Program is intended to be on the consumer shopping and buying experience. When testing the Checkout process, please note the following:

1. Creating an account is optional, you may also checkout as a Guest;
2. You are able to enter dummy data throughout the checkout process (Name, Address, Credit Card). Payment data is not verified until the order is reviewed and submitted. Once you get to the Review page, do NOT click the Submit Order button. NOTE: Any valid purchases made are not eligible for reimbursement as part of this Bug Bounty Program. Focus Areas We are looking for any vulnerability that could negatively affect both the security of our company and that of our customers. The main categories of vulnerabilities that we look for are the following: Remote code execution as root For any remote code execution, avoid uploading any active web shells, or persistence for the validation of bugs, and instead retrieve a hostname, and username for proof of your vulnerability. Remote root login Remote configuration injections Local privilege escalations Unauthorized access to sensitive data Direct exposure of highly sensitive customer data to unauthorized parties, for example: Device secrets Cryptographic keys Customer credentials or PII Cross-site Scripting (XSS) Cross-site Request Forgery Server-Side Request Forgery (SSRF) SQL Injection Remote Code Execution (RCE) XML External Entity Injection (XXE) with significant impact Access Control Issues Authentication Bypass Issues (note: check for exceptions in Excluded Submission Types) Authorization Flaws Privilege Escalation Directory Traversal Issues Sensitive Information Disclosure Data Exposure Business Logic Vulnerabilities Excluded Submission Types This program follows the Bugcrowd Vulnerability Rating Taxonomy with some additional submission types we consider to be excluded below. Dell will not provide rewards for such submissions: Failure to invalidate session for SSO Submissions related to DMARC Missing SPF Records No rate limiting or CAPTCHA Submissions for 3rd party sites where Dell does not own the application Out of date software versions without impact Disclosure of known public files or directories, (e.g. robots.txt) Clickjacking and issues only exploitable through clickjacking Exposure of API keys with no security impact, or where the only impact is exhausting of API quotas Internal IP address disclosure Stack traces displayed on error pages instead of generic error messages Component or technology (e.g. PHP, ASP.NET, etc.) usage is revealed Application allowing username enumeration or user email enumeration Login or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements Malicious file uploads not affecting application server Cookies not set with HTTPOnly or secure flag CSV formula injection Any missing defense-in-depth security measures which cannot be exploited without the existence of some other weakness Reports for assets that are vulnerable to new CVEs that have been in a PUBLISHED status less that 5 business days or a 0-days will be eligible for reward only if we act based on the report. The report will not be eligible for reward if the asset previously reported and remediation has been planned. Reports for credential and token leaks found in third party sites will not be accepted without strong evidence that the data is valid. The reports will also need to provide strong evidence that the leaked data is owned by Dell. Denial of service (DoS) attacks Findings as reported by automated tools without additional analysis as to how and what is vulnerable Open ports without an accompanying proof-of-concept (POC) demonstrating a vulnerability Vulnerabilities only affecting users of outdated or unpatched browsers Spam reports Phishing and social engineering reports Open redirect on SonicWall or similar devices Broken link hijacking on social media accounts Program Rules Legal Terms: By participating in this Bug Bounty Program, you agree to be bound to the terms of this program brief (“Dell Terms & Conditions”). These terms constitute the entire agreement between you and Dell and are governed by Texas law. Any changes to these terms must be in writing. The intent of this Bug Bounty Program is to encourage coordinated disclosure between you and Dell. Unless required by federal law or local law enforcement, Dell does not intend to pursue litigation against research and disclosure that meets the Dell Terms & Conditions. If legal action is initiated by a third party against you relative to the Bug Bounty Program and you are in full compliance with the Dell Terms & Conditions, Dell may at its sole discretion take reasonable steps to help make it known that your actions were conducted in compliance with this program. Dell will not publicly disclose the identity of any researcher without their consent, except where required by law. Dell reserves the right to change or modify the Dell Terms & Conditions at any time. Please check for any updates to this program brief before creating a new submission. By participating in this Bug Bounty Program, you waive any rights to the confidentiality of the submitted work and, further, you agree to grant Dell an irrevocable, worldwide, royalty-free, perpetual and transferable license to use the submitted research, disclosure and materials and you waive any claims against Dell based on Dell’s license or the rights granted. Disclosure: This program does not allow researchers to disclose the results of a submission. Public disclosures will make the researcher ineligible for future participation in this or other disclosure or bug bounty programs by Dell. Rewards will not be given for submissions which are publicly disclosed. Rewards: This program does not offer rewards for out-of-scope targets or excluded submission types. Dell will not negotiate in response to duress or threats (e.g., we will not negotiate the payout amount under threat of withholding the vulnerability or threat of releasing the vulnerability or any exposed data to the public). If multiple reports are received for the same issue attributed, the reward will be awarded to the earliest report containing enough information to reproduce. Dell will not offer rewards for previously known issues. Dell determines duplicates at its sole discretion and will not share details on other reports. Identical issues across different production and non-production environment counterparts will be considered duplicates. Identical issues across different sub domains that share code will be considered duplicates. Researchers with valid reports will be awarded platform points and listed on Dell’s Bugcrowd Hall of Fame . Testing: Use only your assigned account for testing purposes. Do not attempt to gain access to other user’s accounts or compromise any user or Dell confidential information. Testing must not violate any applicable laws or regulations or disrupt or compromise any data that is not your own. If you inadvertently cause a violation or disruption (such as accessing the data of other users, service configurations, or other confidential information) while testing, please report the incident immediately to [email protected] . Any data accessed during your testing must not be used, disclosed, stored, or recorded in any way. Do not exploit a vulnerability you discover beyond what is needed to obtain the proof of concept. Automated vulnerability scanning tools are strictly prohibited as part of this and any other Dell program. Denial of Service (DoS) and Distributed Denial of Service (DDoS) based attacks are strictly prohibited as part of this and any other Dell program. Eligibility You are not eligible to participate in this bug bounty program if you are: A current employee of Dell or a Dell subsidiary, or an immediate family (parent, sibling, spouse, or child) or household member of such an employee. A contingent staff member, contractor or vendor employee currently working with Dell. A former employee or contractor of Dell who was involved in the development or testing of the Dell product listed as the target in the Bug Bounty Program. Located in a non-United States export/trade sanction country.

In Scope - No Monetary Rewards (in scope)

Any domain or target that is not listed in other Target Groups are in-scope for this program but not eligible for monetary rewards.

Out of Scope (out of scope)

XSS on the https://www.dell.com/Identity/global/* target XSS on the https://www-poc.dell.com/Identity/* target XSS on the https://pilot.search.dell.com/Identity/global/* target XSS on the https://www.dell.com/sso/sm/* target Note: When testing any of the application forms on the finance directory you will need stop before actually submitting the form/application. Examples of finance forms you should NOT submit. https://www.dell.com/financing/comm/dpamarcom/CreditApp https://www.dell.com/Financing/Comm/PreQual?cookieUpdated=true