Elastic APM Server

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Observability - APM Server row) │ $7,000 │ $8,000 High │ $3,000 │ $3,750 Medium │ $1,500 │ $1,875 Low │ $700 │ $875 Submit a vulnerability CVE history 0 Last 12 months 5 Lifetime Parsing/validation 35 % Denial of service 25 % Info disclosure 20 % Access control 15 % Latest advisories Loading the feed Overview APM Server is the ingest tier of Elastic Observability, one of the two or three most widely deployed self-hosted APM stacks in existence and the default choice for any organisation already running the Elastic Stack for logs. Its footprint tracks Elasticsearch's, which is to say enterprise, telco and public-sector estates, every major cloud marketplace, and the observability substrate under a large fraction of managed security services. What makes it an unusually interesting target is its position rather than its install count: it is a network service whose entire job is to accept and parse structured data submitted by other software, including, in the RUM case, by unauthenticated browsers on the public internet. It sits inside the trust boundary, holds Elasticsearch credentials, and is routinely exposed more widely than the cluster behind it, so a parsing bug there is a pre-authentication path from the internet into the logging backbone. Elastic N.V. pays it on HackerOne against a bound row running from $700 for a Low to $7,000 for a Critical, awarded at triage rather than at fix. sorona.xyz adds 1.25x on top of whatever Elastic awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~11 hours First response ~6 days Triage ~43 days Bounty In scope The declared asset is Observability - APM Server, bounty-eligible up to critical severity, and Elastic's asset template names the artefacts it covers: the platform downloads, the official container, the github.com/elastic/apm-server source and an instance on Elastic Cloud, on any currently supported version Elastic asks for the product as a whole rather than a component list: 'We are specifically interested in any/all bugs related to the Elastic suite of products... If we wrote code with a bug in it, we want to know about it! Our code is open so use that to your advantage!' Everything the server listens on, outside x-pack/ : the v2 intake API at /intake/v2/events and /intake/v2/rum/events , the NDJSON stream decoder behind them, and the rate limiting and CORS handling that guard the RUM path The OTLP endpoints over gRPC and HTTP, and the Jaeger ingest APM Server exposes so that non-Elastic agents can send it data Agent central configuration at /config/v1/agents , which pulls settings from Kibana and hands them back to agents in the field, plus the source-map upload and consumption path The processing pipeline: sampling, tail-based sampling, aggregation, the model transformation that turns an event into an Elasticsearch document, and the bulk indexer that writes it The authentication and transport surface: secret tokens, API keys, anonymous RUM access, TLS configuration, and the credentials APM Server holds for its Elasticsearch connection Configuration and operational surfaces the binary ships with, including apm-server.yml handling and the built-in monitoring and profiling endpoints Out of scope Reports that reach Elastic by any route other than its own HackerOne program, since email submissions are explicitly not eligible for a reward x-pack/ for the purposes of 'is this open source', though not for the purposes of payment; that code is still bounty-eligible on the same row Security issues in third-party systems, domains, services and components, which 'fall outside this policy and are not eligible for a bounty' Volumetric denial of service: 'network flooding, request flooding, port flooding, required traffic volume scaling with deployment size' is never eligible for a bounty reward Previously known vulnerable libraries reported without a working proof of concept showing reachability through APM Server Findings that require admin or root OS privileges, or that amount to a Low availability impact from an already-administrative position Application-layer findings shown only on a deployment below the 1 CPU and 2 GB RAM floor the program requires Assets from Elastic acquisitions made within the last six months Most-valued findings A parsing or validation flaw in the v2 intake NDJSON decoder reachable pre-authentication from a RUM endpoint, the top class at 35% and the shortest route from the open internet to the $7,000 critical row Memory corruption or code execution in any ingest path that processes agent-submitted or OTLP/Jaeger-submitted data Disclosure of the Elasticsearch credentials or agent secret tokens APM Server holds, which hands over the backing cluster rather than just the ingest tier Access-control failure in the agent configuration endpoint that lets one caller read or influence configuration meant for another deployment A single crafted event or stream that stalls or crashes the server, provided the effect does not scale with traffic volume Cross-service or cross-tenant data landing in the wrong Elasticsearch documents through the model transformation or sampling pipeline Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Bounty eligibility is conditional on exclusive routing through hackerone.com/elastic; reports sent by email are explicitly not eligible for a reward Application-layer attacks must be reproduced on a deployment with no less than 1 CPU and 2 GB of RAM Only currently maintained releases count; an issue that reproduces solely on an EOL build is out of scope Findings requiring administrative or root OS privileges are out of scope, as is a Low availability impact reachable only from an administrative position Volumetric denial of service is never eligible, so a request-flood or bandwidth-scaling result will not be paid however severe the outage The x-pack/ subtree is Elastic License 2.0 and is not open source; it remains bounty-eligible but should not be routed as an open-source finding Program stats 891 Reports resolved $986k Bounties paid 79% Response efficiency Disclosure Coordinated by Elastic, which is its own CVE Numbering Authority and publishes the outcome as an Elastic Security Advisory. Because the policy conditions bounty eligibility on exclusive submission through Elastic's own program, file there first; Elastic states it awards bounty-eligible reports at triage, which is unusually early. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability