Majid Al Futtaim Retail

Description

Carrefour UAE invites you to test and help secure our primary publicly facing assets - focusing on our web and mobile applications. We appreciate your efforts and hard work in making the internet (and Carrefour UAE) more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Valid P4 reports will be upgraded to P3 and paid at the following range: $150 - $200

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Carrefour UAE not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Carrefour UAE, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.* Access Targets are geo-blocked by Akamai. Please use the VPN connection provided at the bottom of the brief. Credentials: To test the mobile applications and websites, please feel free to provision your own account(s) using your @bugcrowdninja.com e-mail address. More information on the Bugcrowd Ninja e-mail address can be found here: https://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address To test the checkout process, use only the Visa and Mastercard test cards found here: https://www.cybersource.com/developers/other_resources/quick_references/test_cc_numbers/ Focus Areas Payment cycle (e.g. buying without completing payment, manipulation of payment amount, etc...) Ability to buy goods without payment Unauthorized changes to reward points (earning or burning reward points) Ability to remotely gain access to other user's PCI details credit cards, CVV, etc) Ability to remotely gain access to other user's personal details (first name, last name, contact details, passwords, etc) Exfiltration of personal data or credit card data Remote unauthorized access to MAF Carrefour database Abuse of vouchers and promo codes Remote code execution Defacement Out-of-Scope The following is not allowed: Placing real cash on delivery orders. Modifying data residing in an account that does not belong to you Accessing or downloading data beyond the minimum required to demonstrate a vulnerability. This should not exceed 1-2 records if at all necessary. Attempting to execute actions that disrupt the availability of our systems (e.g. any volumetric or denial of service attacks) Posting, transmit, upload, link to, send, or store any malicious software Testing in a manner that would result in the sending of unsolicited or unauthorized junk mail, SMS, spam, or other forms of duplicative or unsolicited messages Testing in a manner that would degrade the performance or operation of any system Testing third-party applications, websites, or services that integrate with or link to our systems Making any changes to the system configurations, files, or data Introducing a backdoor in any system Conducting non-technical attacks such as social engineering or phishing Attacking/interacting with our end users in any way. Engaging in the trade of stolen/breached user credentials or use leaked credential dumps in the testing (no credential stuffing is allowed) Reporting any DMARC related issue for any in-scope domain Please give Carrefour 15 business days to apply any official patches for public zero-day vulnerabilities. Any submissions that are made prior to that window being closed will not be accepted. Credential leaks reports are appreciated, but they are not eligible for reward. Authentication issues on https://identity.majidalfuttaim.com/ must be reported to our MPASS program .

MAF-Retail (in scope)

Target Information: You will test Carrefour's main web e-commerce application on a UAT instance and mobile clients on the production side. The web UAT instance includes all the functionality from the production applicattion including product sorting, purchase and payment process (for which you will find testing VISA and Mastercard cards below). The APIs included in scope are used by in-scope the mobile applications, which will point to the production instance.