Dell Technologies' Products Bug Bounty Program

Description

Dell Technologies Product Bug Bounty Program Dell Technologies ("Dell") recognizes the value of the security community to create a more secure world and welcomes the opportunity to collaborate with community members who share this common goal. This Bug Bounty Program applies to security vulnerabilities identified within Dell-branded or currently supported products. Please carefully review the inclusions and exclusions detailed in the sections below. Triage Process - Please Read First In order for Dell to properly reproduce a security report, it is required to enter the Product Name and Version Number of the vulnerable device in the URL / Location of vulnerability field. Reports that do not have this information will be rejected. Submissions with Blockers on them for longer than 5 business days will closed as Not Applicable . Once a Product and Version are confirmed by Dell, a report will be moved to Triaged to validate the report and assign an Impact. In order to help expedite the Triage process, please ensure reports have: Bulleted, step-by-step reproduction instructions Attach any scripts used in the exploit Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Target Information Products: Dell does not provide products for security testing. Any testing by the researcher should only be against Dell products which you have authorized access. Focus Areas We are looking for any vulnerability that could negatively affect the security of our company and our customers. The main categories of vulnerabilities that we look for are the following: Remote code execution as root Remote root login Remote configuration injections Local privilege escalations Unauthorized access to sensitive data Direct exposure of highly sensitive customer data to unauthorized parties, for example: Device secrets Cryptographic keys Customer credentials or PII Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) Server-Side Request Forgery (SSRF) SQL Injection Remote Code Execution (RCE) XML External Entity Injection (XXE) with significant impact Access Control Issues Authentication Bypass Issues Authorization Flaws Privilege Escalation Directory Traversal Issues Sensitive Information Disclosure Data Exposure Business Logic Vulnerabilities Excluded Submission Types This program follows the Bugcrowd Vulnerability Rating Taxonomy with some additional submission types we consider to be excluded below. Dell will not reward points for the following (including but not limited to) submission types: Application Installation to Insecure User Controlled Path Out of date software versions Reports for assets that are vulnerable to CVEs or 0-days which are less than 30 days since initial publication (CVE List Status of PUBLISHED) will be eligible for reward only if we act based on the report. The report will not be eligible for reward if the asset was previously reported, and remediation has been planned. No rate limiting or CAPTCHA Submissions for 3rd party code where Dell is not responsible for the code Attacks requiring physical or administrative access to Dell products or systems Physical tampering of our hardware devices Any code execution requires full admin privileges to exploit on the Dell products Disclosure of known public files or directories, (e.g. robots.txt) Clickjacking and issues only exploitable through clickjacking Login or Forgot Password page brute force and account lockout not enforced Exposure of API keys with no security impact, or where the only impact is exhausting of API quotas Stack traces displayed on error pages instead of generic error messages Component or technology (e.g. PHP, ASP.NET, etc.) usage is revealed Application allowing username enumeration or user email enumeration Login or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements Malicious file uploads not affecting application server Cookies not set with HTTPOnly or secure flag Any missing defense-in-depth security measures which cannot be exploited without the existence of some other weakness Reports for assets that are vulnerable to recent CVEs or 0-days will be eligible for reward only if we act based on the report. The report may not be eligible for reward if the asset previously reported and remediation has been planned. Denial of service (DoS) attacks Findings as reported by automated tools without additional analysis as to how and what is vulnerable Open ports without an accompanying proof-of-concept (POC) demonstrating a vulnerability Vulnerabilities only affecting users of outdated or unpatched browsers Product List The following products are in-scope for Bounty Rewards. This list is subject to change at any time: Client Solutions Hardware Products Consumer Platforms (i.e., Inspiron, Alienware, XPS) Commercial Platforms (i.e., Latitude, OptiPlex, Precision, Rugged, Latitude Education, Chrome, Dell Thin Client) Dell-branded client peripherals Software Products Alienware Command Center Alienware OC Controls Alienware Update Dell Command Configure Dell Command Integration Suite for System Center Dell Command Intel vPro Out of Band Dell Command Monitor Dell Command Powershell Provider Dell Command Repository Manager Dell Command Update Dell Core Services Cloud Dell Customer Connect Dell Hybrid Client Dell OS Recovery Tool Dell Optimizer Dell Performance Manager Dell Display and Peripheral Manager Dell Power Manager Dell Pro AI Studio Dell Remediation Platform Dell Rugged Control Center Dell SupportAssist OS Recovery Dell SupportAssist for Home PCs Dell SupportAssist for Business PCs Dell Telemetry Platform Service Dell Trusted Device Dell Update Dell Web Services Wyse Management Suite Wyse Proprietary OS (Modern ThinOS) Infrastructure - Servers, Storage and Networking Common Event Enabler (CEE) Data Protection Central Dell AppSync Dell BSAFE Dell Cloud Disaster Recovery Dell CloudLink Dell Container Storage Modules Dell Data Lakehouse Dell ECS Dell Enterprise Storage Analytics for vRealize Operations Dell Networking C Series Switch Dell Networking H-Series Edge Switch Dell Networking X-Series Smart Managed Switches Dell OpenManage Enterprise Modular Dell OpenManage Enterprise Dell OpenManage Network Integration Dell OpenManage Integration for ServiceNow Dell OpenManage Enterprise Power Manager Plugin Dell OpenManage Server Administrator Dell OpenManage Enterprise Services Dell OpenManage Connections - ServiceNow Dell OpenManage Integration with Microsoft Windows Admin Center Dell PowerEdge - 16th and 17th generation servers Dell PowerFlex Dell PowerMax Dell PowerProtect Cyber Recovery Dell PowerProtect Data Manager Dell PowerProtect DD Series Appliance Dell PowerProtect DP Series Appliance Dell PowerScale Dell PowerStore Dell PowerSwitch Dell Repository Manager (DRM) Dell SC Series Fibre Channel and iSCSI Drivers Dell SCOM SNMP Management Pack Suite Dell SD-WAN Edge Dell Secure Connect Gateway (SCG) Dell Server Update Utility (SUU) Dell Storage Manager Dell System Update (DSU) Dell Unity Dell Update Manger plugin (UMP) Dell Virtual Storage Integrator for VMware vSphere Client Dell VxRail HCI Enterprise SONiC Distribution PowerEdge M-Series Blade Switch SmartFabric OS10 SmartFabric Storage Software Transparent Snapshot Data Mover (TSDM) Mobile Applications CloudIQ E-Lab Navigator OpenManage Mobile Program Rules Legal Terms: By participating in this Bug Bounty Program, you agree to be bound to the terms of this program brief (“Dell Terms & Conditions”).* These terms constitute the entire agreement between you and Dell, and are governed by Texas law. Any changes to these terms must be in writing. These terms constitute the entire agreement between you and Dell, and are governed by Texas law. Any changes to these terms must be in writing. The intent of this Bug Bounty Program is to encourage coordinated disclosure between you and Dell. Unless required by federal law or local law enforcement, Dell does not intend to pursue litigation against research and disclosure that meets the Dell Terms & Conditions. If legal action is initiated by a third party against you relative to this Bug Bounty Program and you are in full compliance with the Dell Terms & Conditions, Dell may at its sole discretion take reasonable steps to help make it known that your actions were conducted in compliance with this program. Dell will not publicly disclose the identity of any researcher without their consent, except where required by law. Dell reserves the right to change or modify the Dell Terms & Conditions at any time. Check for any updates to this program brief before creating a new submission. By participating in this Bug Bounty Program you waive any rights to the confidentiality of the submitted work and, further, you agree to grant Dell an irrevocable, worldwide, royalty-free, perpetual and transferable license to use the submitted research, disclosure and materials and you waive any claims against Dell based on Dell’s license or the rights granted. Disclosure: This program does not allow researchers to disclose the results of a submission. Public disclosures will make the researcher ineligible for future participation in this or other disclosure or bug bounty programs by Dell. Rewards will not be given for submissions which are publicly disclosed. Rewards: This program does not offer rewards for out-of-scope targets, excluded submission types, or excluded products Dell will not negotiate in response to duress or threats (e.g., we will not negotiate the payout amount under threat of withholding the vulnerability or threat of releasing the vulnerability or any exposed data to the public). If multiple reports are received for the same issue the reward will be awarded to the earliest report containing enough information to reproduce. Dell will not offer rewards for previously known issues. Dell determines duplicates at its sole discretion and will not share details on other reports. Identical issues across different products and environments will be considered duplicates. Only researchers with valid submissions will be listed on the Dell Technologies Hall of Fame . Dell will not acknowledge a researcher on a Hall of Fame separate from Bugcrowd’s unless a CVE is assigned based on the report. With the researcher’s permission Dell Security Advisories will acknowledge the submitter of the finding. Testing: Dell does not provide products for security testing. Any testing by the researcher should only be against Dell products which you have authorized access. Testing must not violate any applicable laws or regulations or disrupt or compromise any data that is not your own. If you inadvertently cause a violation or disruption (such as accessing the data of other users, service configurations, or other confidential information) while testing, report the incident immediately to [email protected] . Any data accessed during your testing must not be used, disclosed, stored, or recorded in any way. Do not exploit a vulnerability you discover beyond what is needed to obtain the proof of concept. Automated vulnerability scanning tools are strictly prohibited as part of this and any other Dell program. Denial of Service (DoS) and Distributed Denial of Service (DDoS) based attacks are strictly prohibited as part of this and any other Dell program. Eligibility You are not eligible to participate in program if you are: A current employee of Dell or a Dell subsidiary, or an immediate family (parent, sibling, spouse, or child) or household member of such an employee. A contingent staff member, contractor or vendor employee currently working with Dell. A former employee or contractor of Dell who was involved in the development or testing of the Dell web property or application listed in the target section. Located in a non-United States export/trade sanction country. If you find a vulnerability that is not in the scope of this Bug Bounty Program, send the report to [email protected] . Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

█████████████████████████████████ (in scope)

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

███████████████████████████ (in scope)

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

█████████████████████████████████████████████ (out of scope)

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████