Kiteworks

Description

Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive and save of sensitive content. To this end, we created a platform that delivers content governance, compliance, and protection to customers. The platform unifies, tracks, controls, and secures sensitive content moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all sensitive content communications. Important information on vulnerabilities that require admin privileges As Kiteworks is an on-premises enterprise product, it is administered by corporate administrators responsible for the systems and their user base. For that reason, we do not generally consider vulnerabilities that require administrator privileges (CVSS PR:H) for exploitation to be critical. This would mean that we would down-rate such vulnerabilities to a maximum of CVSS 8.9. XSS Reporting Requirements Please note that for any reports involving Cross-Site Scripting (XSS), a basic proof-of-concept such as a JavaScript alert box (e.g., alert(1) ) will not be considered sufficient for triage or reward. To qualify for a valid report, you must demonstrate a clear and actionable impact resulting from the XSS vulnerability. This includes, but is not limited to: Performing actions on behalf of another user (e.g., creating a new user account or modifying user settings) Exfiltrating sensitive data (e.g., sending authentication cookies or session tokens to an external server) Bypassing security controls or escalating privileges The goal is to understand the real-world risk and exploitability of the issue, so please ensure your report includes a well-documented and impactful demonstration. Submission Rating Kiteworks adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization of submissions but reserves the right to downgrade or upgrade ratings based on actual business impact and CVSS score. In the event of a downgrade, Kiteworks will provide a reasonable justification to the researcher - along with the opportunity to appeal and make a case for a higher priority. Please note Multiple vulnerabilities caused by one underlying issue will be recognized as one vulnerability. For unauthenticated XSS, it will be treated as a High severity. For authenticated XSS, it will be treated as a Medium severity.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Kiteworks not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Kiteworks, you can report it here. However, be aware that it is ineligible for rewards or points-based compensation. Access: 4 User Profiles: Standard User Restricted User Recipient User Custom User For you have been provisioned 1 pseudo-random @bugcrowdninja.com email (for testing access issues between accounts) which, after accepting the program invite, will route all incoming traffic to the email associated with your Bugcrowd account. An invite to the application has been sent to each of these emails in advance, and will be auto-forwarded upon accepting your invitation to the program. To access each user profile, please append a plus ("+") sign, with a combination of the user profile to follow after your email address. For example, if your email address was [email protected], you could access mail via [email protected] or [email protected] or [email protected] or [email protected], For more information regarding the exact user profile configurations, please do access the Resources tab . To access the account visit https://kw-bugcrowd-pub.bounty.kiteworks.dev/ and login with the username structure listed above and password provided. Upon successfully logging in, you will be redirected to an update password process. Out-of-Scope

• Any hypothetical flaw or best practices without exploitable POC - Any security issues in third-party apps or websites that integrate with Kiteworks or third-party libraries - Reports from automated web/mobile vulnerability scanners that have not been validated - Reports that state that software is out of date/vulnerable without a proof-of-concept - Open ports without an accompanying proof-of-concept demonstrating vulnerability - Exposed login panels - Reports that affect only outdated devices, browsers or platforms - Recently publicly disclosed vulnerabilities - Non sensitive information disclosure: stack traces, path disclosure, directory listings, software versions, etc - Issues requiring physical access to a user’s computer/device/email/etc - Bugs that rely on unlikely or statistically improbable user interaction - Vulnerabilities that require privileged user (e.g. root) access - Social engineering attempts - Credential stuffing - Email spoofing and/or missing DMARC records. - Brute force attacks that cannot be demonstrated or completed in a reasonable amount of time - Enumeration/account oracles: possibility to enumerate phone number, email, GUID, etc. and receive back a message indicating it exists - Password and account recovery policies, such as reset link expiration or password complexity - SSL/TLS best practices - "HTTP Host Header" XSS / "Self" XSS - Text/HTML Injection - Logout and other instances of low-severity Cross-Site Request Forgery - Cross-Site Request Forgery not exploitable with Chrome > 80 - Unchained open redirects - CSV injection - Clickjacking/UI redressing - Missing autocomplete attributes - Missing cookie flags - Missing security-related HTTP headers which do not lead directly to a vulnerability - Mixed content warnings - Protocol mismatch - RTLO and related issues - Homograph Attack - Denial of Service attacks - Rate limiting issues - Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC) - Storing malware/bypassing antivirus detection - Bypass of the filetype filter by renaming the file - EXIF Geolocation Data Not Stripped From Uploaded Images - Domain/Sub-domain take over - Race condition Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

████████████████ (in scope)

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████