K15t

Description

Founded in 2009, K15t GmbH specializes in app development and services for the Atlassian products. With its Scroll apps for Confluence, it is the leading provider of extensions for collaborative content management on the Confluence platform. Backbone Issue Sync extends this collaborative approach to Jira by synchronizing Jira issues across projects and instances for seamless inter-team collaboration. Get Started (tl;dr version) Do not access data of, modify, destroy or otherwise negatively impact Atlassian and K15t customers, or customer data in any way. Please pay attention if the app you are testing is in scope for Cloud or Data Center. Ensure you understand the targets, scopes, exclusions, and rules below - no public disclosure without prior consent. Please No Load testing (DoS/DDoS etc) on the instance. This includes application DoS as well as network DoS. Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs. How to setup your test environment How to set up Cloud instances Create an Atlassian Confluence, Jira or Jira Service Desk Cloud instance here using your @bugcrowdninja.com email address. Install the live version of the in-scope apps from the Atlassian marketplace Get a free trial license, make sure to unsubscribe before the billing cycle starts (after 30 days). Alternatively, you can pay for the Atlassian Cloud instance and App you test, there is currently no way for Cloud vendors to supply you with a promotion code or free Cloud license. Start from 1. after 30 days How to set up Data Center instances Navigate to www.atlassian.com and download the Data Center version of the product you want to test Install it and generate a trial license for the product Install the latest version of the in-scope apps from the Atlassian marketplace and use a timebomb license or start a trial license for each app Start testing Target Apps in Scope Apps in Scope for Cloud Backbone Issue Sync for Jira You must first setup a Jira Cloud instance and then install Backbone Issue Sync from the Atlassian marketplace. Start testing by creating synchronizations between projects and across Jira Cloud instances. To test Backbone Issue Sync with cross-instance synchronization to the full extent you will need two Jira Cloud or Jira Service Desk Cloud instances. Please see our documentation for Backbone Issue Sync for more details. Scroll Exporter apps for Confluence You must first set up a Confluence cloud instance and then install Scroll PDF Exporter , Scroll Word Exporter , or Scroll HTML Exporter along with the Scroll Exporter Extensions app from the Atlassian marketplace. Start testing by exporting Confluence pages using our PDF , Word , and HTML exporters. Create custom export templates for PDF , Word , and HTML exports and add macros and features from the Scroll Exporter Extensions app to your Confluence pages. Please see our documentation about the PDF , Word , or HTML exporters as well as the exporter extensions for more details. Scroll Documents for Confluence You must first set up a Confluence Cloud instance and install Scroll Documents for Confluence from the Atlassian Marketplace. Start testing by creating a new document. Copy the document, create versions of it, apply restrictions to it, compare versions or copies, and create read requests. Please see our documentation for Scroll Documents for more details. Variants for Scroll Documents This is an extension to Scroll Documents for Confluence. Please first install that app and then install Variants for Scroll Documents from the Atlassian Marketplace. Please see the variants-specific section of our documentation for more details. Translations for Scroll Documents This is an extension to Scroll Documents for Confluence. Please first install that app and then install Translations for Scroll Documents from the Atlassian Marketplace. Please see the translations-specific section of our documentation for more details. Scroll Imagemap for Confluence You must first set up a Confluence Cloud instance and install Scroll ImageMap for Confluence from the Atlassian Marketplace. Start testing by adding a new ImageMap macro. Upload an image. Add clickable link areas to other pages in Confluence or external URLs. Use different link area shapes, edit links and tooltips. Please see our documentation for Scroll ImageMap for more details. Scroll Sites for Confluence You must first set up a Confluence Cloud instance and install Scroll Sites for Confluence from the Atlassian Marketplace. Start by creating a site, configuring the theme and previewing and publishing sites - creating, configuring and publishing a site is only available to Confluence administrators and members of the scroll-viewport-admins / scroll-sites-admins group. Please see our documentation for Scroll Sites for more details, note that this app used to be called Scroll Viewport for Confluence. Scroll Content Quality for Confluence You must first set up a Confluence Cloud instance and install Scroll Content Quality for Confluence from the Atlassian Marketplace. Start testing by enabling it in a space and then check some pages. See our getting started docs for more details. Apps in Scope for Data Center Scroll Exporter apps for Confluence You must first set up a Confluence Data Center instance and then install Scroll PDF Exporter , Scroll Word Exporter , and the Scroll HTML Exporter from the Atlassian marketplace. Start testing by exporting Confluence pages using our exporters. Create custom export templates for PDF , Word , and HTML exports and add macros and features to your Confluence pages. Please see our documentation about the PDF , Word , and HTML exporters for more details. Scroll Documents for Confluence You must first set up a Confluence Data Center instance and install Scroll Documents for Confluence from the Atlassian Marketplace. Start testing by creating a new document. Copy the document, create versions of it, apply restrictions to it, compare versions or copies, and create read requests. Please see our documentation for Scroll Documents for more details. Variants for Scroll Documents This is an extension to Scroll Documents for Confluence. Please first install that app and then install Variants for Scroll Documents from the Atlassian Marketplace. Please see the variants-specific section of our documentation for more details. Translations for Scroll Documents This is an extension to Scroll Documents for Confluence. Please first install that app and then install Translations for Scroll Documents from the Atlassian Marketplace. Please see the translations-specific section of our documentation for more details. Scroll Imagemap for Confluence You must first set up a Confluence Data Center instance and install Scroll ImageMap for Confluence from the Atlassian Marketplace. Start testing by adding a new ImageMap macro. Upload an image. Add clickable link areas to other pages in Confluence or external URLs. Use different link area shapes, edit links and tooltips. Please see our documentation for Scroll ImageMap for more details. Scroll Versions for Confluence You must first set up a Confluence Data Center instance and then install Scroll Versions from the Atlassian marketplace. Start testing by following our Get Started Guide . Please see our documentation for Scroll Versions for more details. Scroll Translations for Confluence You must first set up a Confluence Data Center instance and then install Scroll Translations from the Atlassian marketplace. Start testing by following our Get Started Guide . Please see our documentation for Scroll Translations for more details. Scroll Sites for Confluence You must first set up a Confluence Data Center instance and then install Scroll Sites from the Atlassian marketplace. Start testing by creating Confluence spaces and pages and publishing them as Viewports using our app. More advanced configurations can integrate content from Scroll Versions and Scroll Translations (see above) into a Viewport. Note that Confluence and space administrators can add custom Velocity, JS, CSS and HTML to Viewports - this is a feature of the app. Users with only View and Edit permission should not be able to do that - e.g. by including malicious payload into Confluence pages. Please see our documentation for Scroll Sites for more details, note that this app used to be called Scroll Viewport for Confluence. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the app targets listed as In-Scope. Only domains of the form .addons.k15t.com/, .k15t.app/, and .scrollhelp.site/ are in scope. Any other domain/property of K15t is out of scope. Please note that the marketplace.atlassian.com links point to the relevant listings of the apps in scope, but the Atlassian marketplace is not part of this bounty program. If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting. Ensure you review the out of scope and exclusions list for further details. Target Info: Specific Focus Areas for Backbone Issue Sync for Jira Unauthorized Cross Instance / Cross Tenant Data Leakage/Access - As Backbone Issue Sync for Jira can synchronize data across Jira Cloud instances, that data access is expected, but the usage of Backbone must have been authorized by both tenants and only data that is explicitly configured to be synchronized MUST be synchronized. ​ Specific Focus Area for Scroll Documents Document content confidentiality: document content, i.e. the page content in the page tree, is not made available or disclosed, in particular through our backend tasks, to unauthorized entities. ​ Specific Focus Area for Scroll Viewport XSS created through authoring content in Confluence; SSRF during site generation ​ General Focus Areas Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Path/Directory Traversal Issues ​ Please No Load testing (DoS/DDoS etc) on the instance. This includes application DoS as well as network DoS. Exclusions and Rules Specific Exclusions for Scroll Word Exporter Findings about being able to use custom Word templates with embedded scripts for Scroll Word Exporter to create resulting documents that can contain malicious code. ###Specific Exclusions for Scroll HTML Exporter Findings about security issues in exported HTML files that are caused by modifying the exported files or adding custom Javascript. ​ General Exclusions Vulnerabilities found in the Atlassian host application including its API or in the Atlassian Connect API or integration mechanisms will not be eligible for a payout. However, you can submit these vulnerabilities in this public program https://bugcrowd.com/atlassian . Blind XSS must not return any user data that you do not have access to (e.g. Screenshots, cookies that aren't owned by you, etc); when testing for blind XSS, please use the least invasive test possible (e.g. calling 1x1 image or nonexistent page on your web server, etc). No pivoting or post exploitation attacks (i.e. using a vulnerability to find another vulnerability) are allowed on this program. DO NOT under any circumstance leverage a finding to identify further issues. Customer cloud instances and data are explicitly out of scope. The following finding types are specifically excluded from the bounty The use of Automated scanners is strictly prohibited Descriptive error messages (e.g. Stack Traces, application or server errors). Fingerprinting / banner disclosure on common/public services. Clickjacking and issues only exploitable through clickjacking. CSRF attacks that require knowledge of the CSRF token (e.g. attacks involving a local machine). Logout Cross-Site Request Forgery (logout CSRF). Content Spoofing. Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of Secure/HTTPOnly flags on non-sensitive Cookies. Lack of Security Speedbump when leaving the site. Weak Captcha / Captcha Bypass. Login or Forgot Password page brute force and account lockout not enforced. OPTIONS HTTP method enabled. Username / email enumeration. Missing HTTP security headers, specifically ( https://www.owasp.org/index.php/List_of_useful_HTTP_headers ), e.g. Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP, Content-Security-Policy-Report-Only, Cache-Control, and Pragma HTTP/DNS cache poisoning SSL/TLS Issues, e.g.SSL Attacks such as BEAST, BREACH, Renegotiation attack. SSL Forward secrecy not enabled. SSL weak/insecure cipher suites. No Load testing (DoS/DDoS etc) is allowed on the instance. This includes application DoS as well as network DoS. Self-XSS reports will not be accepted. Similarly, any XSS where local access is required (i.e. User-Agent Header injection) will not be accepted. The only exception will be if you can show a working off-path MiTM attack that will allow for the XSS to trigger. Vulnerabilities that are limited to unsupported browsers will not be accepted (i.e. "this exploit only works in IE6/IE7"). A list of supported browsers can be found here . Known vulnerabilities in used libraries, or the reports that a K15t product uses an outdated third-party library (e.g. jQuery, Apache HttpComponents, etc) unless you can prove exploitability. Missing or incorrect SPF records of any kind. Missing or incorrect DMARC records of any kind. Source code disclosure vulnerabilities. Information disclosure of non-confidential information (e. g. issue id, project id, commit hashes). The ability to upload/download viruses or malicious files to the platform. Email bombing/Flooding/rate limiting ​ Rules This bounty follows Bugcrowd's standard disclosure terms, which is non-disclosure. K15t will choose the appropriate form of disclosure according to our Security Bug Fixing Policy . Note: K15t uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, K15t will defer to the CVSS score to determine the priority. Public Disclosure Before disclosing an issue publicly we require that you first request permission from us. K15t will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without K15t's written consent will have any allocated bounty withdrawn and disqualified from the program. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.