Kohl's

Description

Kohl's is taking the next step in securing our applications. We invite researchers through Bugcrowd's bug bounty program to test our site and let us know how we're doing. Kohl's knows that securing our applications and networks requires collaboration with the security community and will reward those researchers who find in scope vulnerabilities by following our Bug Bounty program and scope. Please read this brief and its stated conditions COMPLETELY before doing any penetration testing. Failure to comply may result in not being able to collect a reward. Rewards/Ratings: This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization and rating of findings, except for the specific vulnerabilities listed below: VRT category │ Specific vuln name │ Variant / Affected function │ Technical severity Server Security Misconfiguration │ Misconfigured DNS │ Subdomain Takeover │ 4 Cross-Site Scripting (XSS) │ Reflected │ Non-Self │ 5 Sensitive Data Exposure │ Disclosure of Secrets │ For Publicly Accessible Asset │ Varies Broken Authentication and Session Management │ Authentication Bypass │ │ Varies Server-Side Injection │ Content Spoofing │ iframe Injection │ 4 LLE or staging environments are generally"kudos only," unless significant risk can be demonstrated. However, infrastructure related issues will be paid as per the severity. All the findings will be reviewed case-by-case and rewarded accordingly. Multiple vulnerabilities with same root cause will be grouped and awarded one bounty.

Targets

Access: We encourage you to sign up for any accounts that you can self-provision on the in-scope targets. When creating an account, please use your @bugcrowdninja.com email address. For additional information about @bugcrowdninja email addresses, refer to the documentation here . Additionally, to avoid being blocked, make sure to modify your user-agent string. All researchers conducting tests should include the User-Agent header in their requests, using the following format: <[username]@bugcrowdninja.com> . ​ Focus Areas Kohl's Cash, Rewards points, and Loyalty programs. (this should not impact actual customers, including redeeming Kohl’s Cash or Rewards Balance, use your test accounts) Payment workflow. Abuse of functionality leading to fraud. (KohlsPay / Rewards / KohlsCash) Accessing PII, PCI, and other sensitive data. (If found, stop enumerating the data, report the issue, and delete local copies) Horizontal escalation (accessing other users data - Only interact with your own test account) Deserialization vulnerabilities​. Scanning Activity: Please do not use automated vulnerability scanners on this program. Custom scripts and fuzzing tools are permitted, but if using them, please keep your traffic to six requests per second or less. Additionally, it’s worth noting that the client already runs automated scans from Acunetix, Zap, Nessus, et al., against the in-scope targets – so using these tools is likely of minimal utility to researchers. As such, please avoid using them unless for targeted, specific testing, and then only at less than six requests per second. Out-of-Scope Vulnerabilities Avoid any actions that cause DoS attacks. Avoid any activities that result in spam emails being sent to other Kohl's customers or employees. Do not physically test Kohl's stores by accessing or plugging devices into Kohl's properties. Username/email/account enumeration, credential stuffing, and brute-forcing passwords are prohibited. Social engineering is prohibited. Do not upload code that negatively impacts Kohl’s infrastructure or other customers. Proof of concepts should be limited to the least impactful actions that demonstrate vulnerabilities. When uncertain, seek guidance. Missing Headers (i.e, secure, Httponly, OPTIONS/TRACE, etc) Mail configuration issues (SPF, DKIM, DMARC settings). Lack of email address verification during account registration. Mixed content issues Address other best practice issues (e.g., SSL/TLS, DNS, CSP).