Entain Public Managed Bug Bounty Engagement 2024

Description

The Entain Group appreciates the important work of the security community and its researchers who identify and report potential vulnerabilities. No technology is perfect and we believe that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web and mobile apps. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Entain not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Entain, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary compensation. Target Information: Access: You are testing on production. Behavior that compromises the stability and integrity of the site is out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it. Credentials: To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas: GDPR, any way to access other customers data Game function and logic, any way to cheat or steal winnings Third party services Entain uses third-party providers and services – including a number hosted on subdomains across our brands that will be considered Out of Scope for this program. We cannot authorise security testing against systems that do not belong to us, however we would encourage you to report any issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of Entain's misconfiguration or insecure usage of that service, we would appreciate it greatly if you could share your finding. If you are unsure if a particular asset is in scope or sits with a third party within this program, please reach out to Bugcrowd Support Portal and we will help you out. Out-of-Scope Anything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. However to help avoid grey areas, below are examples of what is considered out of scope. The use of Automated scanners is prohibited (we have these tools and its reports too) Arbitrary file upload without references to an uploaded file Best practices violations (password complexity, expiration, re-use, etc.) Clickjacking without a suitably demonstrated impact CORS missconfigurations on non sensitive endpoints Cross-domain referrer leakage Cross-site Request Forgery (CSRF) without a proven impact CSV Injection Disclosing API keys without proven impact (including Google Maps API) E-mail bombing due to a lack of rate limiting E-mail spoofing issues - SPF, DMARC or DKIM Homograph attacks Host Header Injection HTTP Request smuggling without any proven impact Image Metadata Missing autocomplete attribute on login fields. Missing cookie flags on non-session based cookies Missing HTTP security headers (as referenced by https://owasp.org/www-project-secure-headers/) Mixed content type issues Open redirects for product domains are accepted, but are not qualified for reward unless there is additional security impact, e.g. ability to steal authentication token. Open ports without a proven impact Rate limit issues without a proven impact Reverse tabnabbing Self-XSS Session Invalidation Issues (logout, change password, adding 2fa) SSL configuration issues (ie. TLS versions, weak ciphers, forward secrecy enabled...) Username / email enumeration Vulnerabilities primarily caused by browser/plugin defects and not representative of defects in the security of Entain systems Vulnerability reports related to the reported version numbers of web servers, services, or frameworks Vulnerability reports relating to sites, software or network devices not owned by the Entain Group XMLRPC enabled or WP-Scripts Presence Current employees, former employees, and any members of their immediate families are not eligible to participate in this Bug Bounty Program. Public Disclosure Before disclosing an issue publicly we require that you first request permission from us. Entain will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without Entain's group written consent will have any allocated bounty withdrawn and disqualified from the program. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.