Mastercard Public Bug Bounty

Description

Program Details Mastercard is the leading technology company in the worldwide payments industry. We run the fastest payments processing network in the world, tying together consumers, financial institutions, merchants, and governments across more than 210 nations and territories. Everyday commerce activities like buying, travelling, operating a business, and managing finances are made simpler, more secure, and more effective for everyone by Mastercard products and solutions. Mastercard is dedicated to increasing digital security as payment systems develop, which includes thorough testing for any vulnerabilities. By letting us know about any weaknesses, you can earn rewards while also assisting us in making our products and services even safer. Eligibility for Participation To be eligible for the Mastercard Bug Bounty Program, you must not : Be a resident of, or make your submission from a country against which the United States has issued export sanctions or other trade restrictions (e.g., Russia, Iran, North Korea, and Syria) Be in violation of any national, state, or local law or regulation. Be employed by Mastercard or its subsidiaries. Be an immediate family member of a person employed b Mastercard or its subsidiaries or affiliates. Be less than 14 years of age. If you are at least 14 years old but are considered a minor in your place of residence, you must get your parent’s or legal guardian’s permission prior to participating in the program. If Mastercard discovers that you meet any of the criteria above, you will be excluded from the Mastercard Bug Bounty program and be disqualified from receiving any Bounty payments. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Access: Mastercard Regional Sites: The regional MasterCard sites are the company’s external websites, which include public information available to unauthenticated users. The sites include outbound links to resources not hosted on the www.mastercard.com domain. Only the core MasterCard domain is in scope and open to testing. Please be mindful of which domain / sub domain you are testing. Priceless : (https://demo.priceless.com) Priceless Cities is a core tenet of MasterCard’s world-renowned 18 year-old Priceless marketing platform that is currently available in 112 countries and 53 languages. The platform provides exclusive curated experiences and special access in over 35 cities marketed in over 52 countries. Accounts can be self-provisioned by using your @bugcrowdninja email. Please use 5555 5555 5555 4444 to register and test orders on demo.priceless.com. Note: <www.priceless.com> was earlier part of bug bounty program but now we have replaced it with test environment <demo.priceless.com> so if similar issues are reported for this, it will be marked as duplicate In scope target <demo.priceless.com> is guarded by HTTP authentication use below username and password for login: Username: mastercard Password: priceLESS. For rest of the applications, no specific test data is required. Mastermind Application: All tests to be performed on this URL: https://performancemarketing.mastercard.com/portal/ To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . SRC : Mastercard Click to Pay service (SRC - Secure Remote Commerce) is the sole target of this engagement. This service provides a fast and convenient checkout experience to customers on online stores. To facilitate your testing we have set up a test store https://masterpassteststore.com/ with the SRC integration (Masterpass) enabled. Please note that the store itself is Out of Scope and only the Masterpass functionality is in scope. Please review the resources section to understand how to get to the in-scope target from a traditional online store. MDES CS API: Targets are accessible through public internet. Please review below attached files for this engagement and insomnia is recommended software to use in order to run those files. Also, Mastercard API plugin needs to be downloaded to be properly authenticated. Additionally, please follow the link for additional information regarding the API functionality. • MDES%20In-scope.txt (in-scope endpoint details) • Environment_MTF_CSAPI.txt (Environment variable) • BBTestUser-production.p12 (P12 file) • Insomnia_2023-01-11.json (Insomnia collection) MDES MTF Account Ranges Range Star No# │ Range End No# │ Brand │ Country Code │ Cust ID │ Length │ FPANs │ Reserved 5204245250000000000 │ 5204245259999999999 │ MCC │ 840 (USA) │ 144136 │ 16 │ 5204245250000084/5204245250000092 │ eCom 5204490310000000000 │ 5204490319999999999 │ MCC │ 840 │ 144136 │ 16 │ 5204490310000217/5204490310000225 DXP: (Mastercard Donate) Researchers are encouraged to create their own accounts by visiting this page: https://donate.mastercard.com/wfp/en-it.html and signing up. When signing up, please use the following credit card info: Card number: 5333170000000008, 5333170000000057 Expiration: 09/24 CVC: 464 Finicity: For Finicity - OBB (Open Banking Business Service) please follow the resources tab in there you will find all the necessary information to connect this API. For www.finicity .com the In Scope functionalities are: Solutions (all the tabs + sub-tabs) Use Cases (all the tabs + sub-tabs) About (all the tabs + sub-tabs) Developer (all the tabs + sub-tabs) Login (Only client hub tab) For Consumer Portal Bug Bounty User Testing: Consumers (here, Bug Bounty Test User with their @bugcrowdninja email IDs) should test the application through this URL: https://consumer.finicityreports.com/login Registration: Consumer portal user can do the self-registration to the portal with their email address on https://consumer.finicityreports.com/signup They can setup their account with the First Name, Last Name, SSN and DOB. (Refer ‘Dummy Set of SSN and DOB’ given at the end of document below) Once done Consumer will get redirected to the dashboard which will display the reports for the consumers and disputes raised by the consumer. Login: Consumer (Bug Bounty Test User) should login application through this URL https://consumer.finicityreports.com/login with the email address used for Registration. i.e., @bugcrowdninja email On successful login consumer will see the dashboard which will display the reports for the consumers and disputes raised by the consumer. Out of Scope: Get Started For Finicity- Open Banking Payment History application please follow the resources tab in there you will find all the necessary information to connect this API. 7 files attached in this brief to access the in-scope services: • OpenAPI specification for Finicity APIs • DS.postman_environment.json • Finicity_DSAPI_COLLECTION.postman_collection.json • Finicity%20Decisioning.postman_collection.json • Prod.postman%20Decisioning_environment.json • Connect%20(Bug%20Bounty%20Test).postman_collection.json • Environment%20Placeholder.postman_environment.json • Connect%20Bug%20Bounty%20Guide.pdf Also, attaching steps to follow for Finicity- Data Services ‘TxPush Notification’ API endpoint: Please see resources tab Bug Submission Requirements Due to GDPR and legal requirements, all testing must be conducted using your @bugcrowdninja.com email ID only. If you fail to use your @Bugcrowdninja.com email ID, you run the risk of getting blocked from accessing Mastercard applications. For all submissions, please include : Full description of the vulnerability being reported, including the exploitability and impact. Evidence and explanation of all steps required to reproduce the submission, which may include: Videos Screenshots Exploit code Traffic logs Web/API requests and responses Email address or user ID of any test accounts IP address used during testing. For Remote Code Execution submissions, see below. Failure to include Email address or user ID of any test accounts and IP address used during testing will result in a 10% penalty against bounty payout. Leaked Credentials If you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance. Remote Code Execution (RCE) Submission Guidelines: Failure to meet the below conditions and requirements could result in a forfeiture of any potential Bounty Payment. Source IP address Timestamp, including time zone. Full server request and responses Filenames of any uploaded files, which must include “bugbounty” and the timestamp. Call-back IP and port, if applicable Any data that was accessed, either deliberately or inadvertently Allowed Actions: Directly injecting benign commands via the web application or interface (e.g., whoami, hostname, ifconfig) Uploading a file that outputs the result of a hard-coded benign command. Prohibited Actions: Uploading files that allow arbitrary commands (i.e., a webshell) Modifying any files or data, including permissions Deleting any files or data Interrupting normal operations (e.g., triggering a reboot) Creating and maintaining a persistent connection to the server Intentionally viewing any files or data beyond what is needed to prove the vulnerability. Failing to disclose any actions taken or applicable required information. Prohibited Testing: Use of automated scanners and tools to find vulnerabilities is strictly not allowed. Mastercard requests that testers do not perform automated/scripted testing of web forms, especially "Contact Us" forms that are designed for customers to contact the Support team. Applications under Public Targets are mostly production applications. Do not deface/add random content in case you find some stored injection/ RCE. Report back to us with PoC and we will test fully in a lower environment (if required) Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure are not allowed. Do NOT test the physical security of Mastercard offices, employees, equipment, etc. Do NOT perform any attack that could harm our services (E.g.: DDoS/Spam). Do NOT attack, in any way, our end users, or engage in trade of stolen user credentials. You may investigate or target vulnerabilities against your own or test accounts, but testing must not disrupt or compromise any data or data access that is not yours. Confidentiality : If your testing or investigation inadvertently causes a privacy violation or disruption (such as accessing account data, service configurations, or other confidential information), please include this information in your report (or email [email protected]) In-scope & Out of scope Vulnerabilities: In-scope focused vulnerabilities: Cross Site Scripting (XSS) Cross Site Request Forgery (CSRF) Insecure direct object references Injection Vulnerabilities Authentication Vulnerabilities Server-side Code Execution Privilege Escalation Significant Security Misconfiguration (when not caused by user) Any out of the box issues which could lead to compromise or leakage of data and directly affect the confidentiality or integrity of user data of which affects user privacy. Out of Scope vulnerabilities specifically excluded from the bounty: Pivoting, scanning, and vulnerability exploitation. Exfiltration of data from Mastercard systems. Email spoofing Missing or incorrect SPF/DMARC/DKIM records of any kind Descriptive error messages (e.g., Stack Traces, application or server errors). Fingerprinting / banner disclosure on common/public services. Clickjacking and issues only exploitable through clickjacking. Login/Logout/Unauthenticated/low impact/anonymous user CSRF. Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of Secure/HTTPOnly flags on non-sensitive Cookies. Lack of Security Speedbump when leaving the site. Weak Captcha / Captcha Bypass Forgot Password page brute force and account lockout not enforced. Username / email enumeration via Login Page error message via Forgot Password error message Any missing/misconfigured HTTP security headers SSL Issues, e.g. SSL Attacks such as BEAST, BREACH, Renegotiation attack SSL Forward secrecy not enabled. SSL weak / insecure cipher suites Vulnerabilities affecting users of outdated browsers IE < 9 Chrome < 40 Firefox < 35 Safari < 7, Opera < 13 Out of scope: Only the targets that are indicated as “In-Scope” above may be tested. Any Mastercard website or asset not specifically mentioned in the “In-Scope” section is out of scope for this program. If you find a security flaw on a target that is outside of the scope but clearly affects Mastercard, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Simplify: • If a link goes outside the www.simplify.com or sandbox.simplify.com domains, it is no longer in scope and should not be tested. • Simplify has two live partners Priority Payment Systems, EVO Payment Systems which are explicitly out of scope. Mastercard Regional Sites: • The regional sites include outbound links to resources not hosted on the www.mastercard.com domain. Only the core MasterCard domain is in scope and open to testing. Developer Portal: All Available Mastercard Developer APIs (The APIs for the developer portal are fully out of scope for this. You may either use an existing account, or create new users are needed using your <@bugcrowdninja.com> address.) Priceless: demo.priceless.com/travel demo.priceless.com/standup Order placement on demo.priceless.com Mastermind application: You are testing on production. Behaviour that compromises the stability and integrity of the site should be out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it. SRC: https://masterpassteststore.com/- https://www.mastercard.us/en-us/personal/ways-to-pay/click-to-pay.html- https://checkout.mastercard.com/- https://secure.checkout.visa.com/* Please note that the store itself is Out of Scope and only the Masterpass functionality is in scope. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support before going any further.

Public Other Targets (in scope)

If you find a security flaw on a target that is outside of the scope mentioned under 'Private' and 'Public' Target but clearly affects Mastercard, you can report it at ''Public Other'' Program. Also, findings related to Mergers and Acquisitions (M&A) could be considered under ‘Public Others’ category. Vendor based application URLs/3rd party URLs: Any Partner Sites of Mastercard (e.g. www.mastercard-*.com) are mainly marketing based sites that are not part of the core Mastercard domains (.mastercard.com) and are managed by hosting vendor companies. Vulnerabilities on these assets will be awarded lower bounties: P1 │ P2 │ P3 │ P4 $700 │ $300 │ $150 │ $50 The reward amount for submissions reported for any lower environment (such as stage, dev, test, sandbox, or UAT) of third-party developed (vendor) applications will be 50% of the standard amount mentioned in above table. give.mastercard.com is a vendor based application and bounty payouts will be according to this table. Recorded Future has a separate bug bounty program. Submissions related to Recorded Future are out of scope for the Mastercard Bug Bounty Program. biz360.mastercard.com and mybiz360.mastercard.com are out of scope from Mastercard bug bounty program Pay-outs for Subdomain Takeover: Pay-outs for Subdomain Takeover findings differ from the rewards listed above. Please review the severity and descriptions below before submitting a report. Impact │ Severity │ Reward │ Description High Impact Subdomain Takeover │ P2 │ $900 │ Awarded for domains and subdomains with reputational or technical risk. Also, for subdomains under a parent domain with reputational or technical risk, and access to sensitive data on that parent domain. Basic Subdomain Takeover │ P3 │ $300 │ Awarded for domains and subdomains under a parent domain with reputational or technical risk, but without access to sensitive data on that parent domain. Concession award │ P4 │ $100 │ Awarded for domains and subdomains that are owned by Mastercard and have no risks except publicity risk (which is inherent in ownership)