EPAM Systems Managed Bug Bounty Program

Description

About EPAM EPAM's global teams serve customers in more than 35 countries across North America, Europe, Asia, and Australia. As a recognized market leader in multiple categories among top global independent research agencies, EPAM was one of only four technology companies to appear on the Forbes 25 Fastest Growing Public Tech Companies list every year of publication since 2013 and has ranked as the top IT services company on Fortune's 100 Fastest-Growing Companies list in 2019 and 2020. We value collaboration, work in partnership with our customers, and strive for the highest standards of excellence. We're remotely supporting operations for hundreds of clients worldwide in today's market conditions. No technology is perfect, and EPAM Systems believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our applications and infrastructure. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases, a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher and the opportunity to appeal and make a case for a higher priority._ Main Guidelines, read closely! ethics.epam.com is out of the program's scope. Do not perform any testing for this target! Every request must include the X-Bugcrowd header with Bugcrowd username, for e.g: Bugcrowd- Must use the Bugcrowd email alias [username]@bugcrowdninja.com. Automation against form submissions is not allowed and can lead to a ban from the program. Do not degrade EPAM's user experience, disrupt production systems, or destroy data during security testing. Please do not test requests for account removal at https://anywhere.epam.com/en/contact-us. We won't accept this as a valid submission Read the program's scope carefully! Violation of any point above will lead to an immediate program ban! Prohibited Activity Automated vulnerability scanners. We need your brainpower, not your processing power.

Targets

Eligibility: For EPAM employees: Usage of EPAM credentials is not allowed. Credentials: To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here Do not use EPAM corporate credentials or any leaked/found/unauthorized credentials to access in-scope systems. Report exposed credentials as a finding — do not use them. Issues reachable only through such access are out of scope. Focus Areas: Different types of injections RCE SSRF XXE Injections Path traversal Stored-cross or reflected site scripting (not self-XSS) PII leakage issues Security misconfigurations with demonstrated security impact Any other vulnerabilities that will give the possibility for threat actors to read files from the server/execute commands/retrieve sensitive information Out-of-Scope To avoid confusion, we kindly ask you to get familiar with the scope of our program before submitting any reports. Testing is only authorized on the targets listed as in scope. Any domain/property of EPAM Systems not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you identify a security vulnerability on a target that is not in scope but demonstrably belongs to EPAM Systems and has a security impact, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Avoid testing any contact forms on epam.com *.epam.com Please do not report information disclosure at https://investors.epam.com/. EPAM is a public company, and financial information is publicly available to our customers and investors. Any vulnerabilities only reachable by authenticating with leaked, found, guessed, or otherwise unauthorized credentials (including EPAM corporate credentials). Discovering exposed credentials should be reported as a finding; using them to access in-scope systems is out of scope and ineligible for reward. Out-of-Scope Vulnerabilities The following issues are considered out-of-scope for our bug bounty program unless they demonstrate a tangible security impact: Clickjacking: Attacks that trick users into clicking on something other than what they intended. Broken Link Hijacking: Cases where broken or misdirected links are exploited. Firebase API Key Exposure: Leaks of Firebase API keys without demonstrated security impact. Session Management Issues: - Session expiration problems after logout. - Inadequate session timeout lengths or account lockout policies. - Failure to invalidate sessions on password reset. Known Vulnerable Components: Use of components with known vulnerabilities without a working proof-of-concept exploit. Business Logic Flaws: Issues in business processes that do not have a demonstrable security impact. Unrestricted File Uploads: File upload issues that lack a demonstrated security impact. API Key Leaks: Disclosure of Google Maps/MapBox API keys. External Service Interactions: Interactions with external services that do not demonstrate a security impact. Password Policies: Issues related solely to password complexity or length. Cross-Site Scripting (XSS): Post-based XSS without a demonstrated security impact. Server-Side Request Forgery (SSRF): Blind SSRF vulnerabilities without demonstrated security impact. Self-XSS: Self-inflicted XSS that does not present a realistic threat. Cross-Site Request Forgery (CSRF): On unauthenticated forms or forms that do not perform sensitive actions. MITM or Physical Access Attacks: Attacks requiring man-in-the-middle techniques or physical access to a user’s device. Known Vulnerable Libraries: Previously reported vulnerabilities without a working exploit. CSV Injection: Comma-Separated Values injection without a demonstrated vulnerability. SSL/TLS Configuration Issues: Deviations from best practices in SSL/TLS settings. Denial of Service (DoS): Any activities that might lead to service disruption. Content Spoofing / Text Injection: Issues where an attack vector isn’t clearly demonstrated (e.g., inability to modify HTML/CSS). Rate Limiting / Brute Force: Problems related to rate limiting or brute force attacks without a tangible impact. Content Security Policy (CSP): Non-adherence to established CSP best practices. Cookie Security: Missing HttpOnly or Secure flags on cookies. Email Security Practices: Issues with SPF, DKIM, or DMARC records (e.g., invalid, incomplete, or missing). Outdated Browser Vulnerabilities: Issues that only affect browsers more than 2 stable versions behind the latest release. Information Disclosure: - Software version and banner disclosures. - Descriptive error messages or headers (e.g., stack traces or server errors). Public Zero-Day Vulnerabilities: Zero-day vulnerabilities that have had an official patch for less than one month (evaluated on a case-by-case basis). Recently Patched or Disclosed Vulnerabilities: Publicly known vulnerabilities that have had an official patch available for less than one month (evaluated on a case-by-case basis). Tabnabbing: Vulnerabilities related to tabnabbing attacks. Unlikely User Interaction: Issues requiring highly improbable user behavior to be exploited. HTML Injection: Without a demonstrated security impact. CRLF Injection: Without a demonstrated security impact. Automated Scanner Reports: Findings solely reported by automated tools. DDoS/DoS Attacks: Denial-of-service attacks or related issues. Cache Poisoning: Without demonstrated security impact. CDN Bypass Techniques: - CloudFront bypass leading to origin IP disclosure. - Cloudflare bypass leading to origin IP disclosure. SharePoint Services: Exposed SharePoint web services without a demonstrable impact. Robots.txt/Sitemap.xml Issues: Findings that do not demonstrate a security impact. FrontPage Configuration Disclosure: Exposure of configuration information without demonstrated impact. User/Email Enumeration: Issues that simply enumerate users or emails. Cleartext Password Transmission: Sending passwords over HTTP instead of HTTPS. Dependency Confusion: Vulnerabilities arising from dependency misconfigurations. EXIF Data Exposure: Failure to strip geolocation data from uploaded images/documents. WordPress Issues: - Disclosure or enumeration of WordPress users. - Enabled xmlrpc.php on WordPress installations. Cache-Control Misconfigurations: Improper or missing cache-control headers. Domain takeover issues have been identified on subdomains under *.lab.epam.com and domains including *.projects.epam.com. These zones are used for non-production sandboxed environments and demos. Please note that to be eligible for a bounty, vulnerabilities must clearly demonstrate a tangible security impact. Out-of-Scope Mobile Vulnerabilities The following mobile issues are considered out-of-scope for our bug bounty program unless they demonstrate a tangible security impact: Google Maps API Key Leakage: Disclosure of Google Maps API keys. Broken Link Hijacking: Exploitation of broken or misdirected links. Firebase API Key Exposure: Leaks of Firebase API keys without demonstrated security impact. Reverse Engineering: Decompiling or reverse engineering an app. SQL Injection in Content Providers: SQL injection vulnerabilities in content providers that do not result in a privilege escalation. Root Detection Issues: Cases where the application does not detect if it is on a rooted device. Rooted/Jailbroken/Emulator-Only Issues: Vulnerabilities that only occur on rooted/jailbroken devices or emulators. Phishing and Social Engineering: Attacks relying on phishing or social engineering techniques. Excessive Permissions: Instances where an app requests excessive permissions without demonstrable risk. Hardware Attacks: Vulnerabilities requiring physical hardware attacks. Developer Mode Bugs: Issues related to developer mode that do not impact security. Non-Eligible Device Versions: Reports concerning device versions that are not supported. Tapjacking: Vulnerabilities related to tapjacking attacks. Sensitive Data in Screenshots: Instances where screenshots display sensitive application data. Certificate Pinning: Misconfigurations or issues related to certificate pinning. Binary Protection Absence: Lack of binary protection measures, such as the absence of a Stack Canary. Extensive User Interaction Requirements: Vulnerabilities requiring extensive user interaction. Exposure of Non-Sensitive Data: Cases where only non-sensitive data is exposed on the device. Third-Party Library Vulnerabilities: Vulnerabilities in third-party libraries without showing specific impact on the target application. Deprecated/Banned API Usage: Use of deprecated or banned APIs. Sensitive Info in Logs: Exposure of sensitive information in logs from staging or test builds. Exported Components: Exporting an activity, receiver, content provider, or service is not considered a vulnerability unless it can be used to gain unauthorized access to application data or functionality. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going further.

In Scope Targets - Tier 1 (in scope)

Avoid testing any contact forms on *.epam.com and epam.com. Third-level subdomains at *.epam.com and epam.com are valid targets for Tier 1 bounties.

Subdomain takeover - Tier 0 (in scope)

Subdomains under *.lab.epam.com, *.projects.epam.com, and *.opensource.epam.com are out of scope and will generally not be considered for rewards. Subdomains under *.gcp.cloudapp.epam.com are considered out of scope for reward eligibility. These subdomains are dynamically provisioned as part of our development and infrastructure automation processes (e.g., via GKE), and are subject to frequent creation and teardown. As such, they may appear vulnerable to subdomain takeover due to normal lifecycle operations, not due to a misconfiguration. Because of this ephemeral nature, subdomain takeovers at *.gcp.cloudapp.epam.com will not be rewarded, unless: • A working proof-of-concept remains live and verifiable for an extended period of time, and • The issue can be clearly demonstrated as a genuine misconfiguration rather than a result of intended infrastructure behavior. Additionally, any domain that is not under *.epam.com is strictly out of scope.

In Scope Targets - Tier 2 (in scope)

Any level subdomains at *.projects.epam.com are valid targets for Tier 2 bounties. P3 and P4 submissions will be accepted as valid submissions but won't be rewarded with bounties.

In Scope Targets - Tier 3 (in scope)

Any level subdomains at *.lab.epam.com and *.opensource.epam.com are valid targets for Tier 3 bounties. P3 and P4 submissions will be accepted as valid submissions but won't be rewarded with bounties. Everything under *.lab.epam.com and *.opensource.epam.com is a development environment or project planned to be released to the open-source, and please consider that fake PII data can be used there.

In Scope Targets - Tier 4 (in scope)

Any level subdomains are valid targets for Tier 4 bounties. P4 submissions will be accepted as valid submissions but won't be rewarded with bounties. Do not perform any testing on: https://www.emakina.nl/ https://www.emakina.group/ https://www.emakina.com/ https://www.emakina.ch/ https://www.emakina.fr/ https://www.emakina.us/ https://www.emakina.at/ Important: Avoid testing any contact forms. Open redirect, host header injection vulnerabilities are outside the scope of Tier 4 targets.

Open redirect (in scope)

Open redirect at 3rd level subdomain *.epam.com

Open redirect - Tier #1 (in scope)

Open redirect at: *.projects.epam.com *.lab.epam.com *.opensource.epam.com

In Scope - Points Only (in scope)

Leaks of credentials and confidential information from malware logs/dumps/intelligence services/public sources would be accepted as valid issues but won't be rewarded with a bounty.