MATLAB Online - Ongoing Bug Bounty Engagement

Description

MATLAB Online extends the capabilities of MATLAB and Simulink to the cloud. You can connect to cloud storage solutions and collaborate on projects through a web browser without installing software. With support for hardware integration and scalable cloud computing, MATLAB Online enhances your workflow for flexible, on-the-go productivity. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of MathWorks not listed explicitly in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to MathWorks, it may be reported through the Vulnerability Disclosure Policy (VDP). More details are available here - Vulnerability Disclosure Policy for Security Researchers - MATLAB & Simulink . Note that VDP submissions are ineligible for rewards or points-based compensation. Please do not submit duplicate submissions across programs. For in-scope target disputed reports, use the Bugcrowd platform to request re-assessment. Engagement Guidelines We do not accept reports that contain low-effort or AI-generated content. Submissions must demonstrate original analysis, clear understanding of the issue, and actionable detail. Reports lacking meaningful human input will be rejected Potential post-exploitation scenarios: If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity Testing is only allowed on content created by your @bugcrowdninja.com Account Any Stored XSS vulnerabilities found in the MATLAB Online will be considered as P3 unless demonstrated to have wider and more severe impact Stored XSS vulnerabilities through file names will be considered P3 Unique, complex, and impactful findings may be elevated to P2 based on demonstrated steps and impact Report Guidelines Vulnerabilities discovered on multiple paths, endpoints, parameters will be treated as duplicates. This includes findings across different environments (e.g., development, staging, production) unless the impact or exploitation method is materially different. Please submit only one report Reports must contain the role used for testing (if any), a clear explanation of the issue and the security impact along with detailed steps to reproduce it. If the issue cannot be reliably reproduced based on your report, it may be considered ineligible for a reward Do not submit more than one vulnerability per report. In cases where demonstrating impact requires chaining multiple vulnerabilities together, those can be included in the same report as long as the linkage is clearly explained Access To ensure uninterrupted access and avoid rate-limiting or blocking during your testing, please include the following custom HTTP header in all of your requests: Required X-Request-Purpose: BugcrowdResearch Optional X-Bugcrowd-Ninja: [username] This helps us identify legitimate testing traffic and prevent accidental interference with real users or automated systems. Failure to include this header may result in your requests being blocked. Credentials Testing is only allowed on content created by your @bugcrowdninja.com Account Mathworks offers Researchers Trial Licenses to access the In-scope Targets. In order to activate a trial license, create a MATLAB Online Account with your bugcrowdninja email address and then visit the MathWorks Researcher Intake and sign in using your account which will give you license to access MATLAB Online. Once the license association is complete you should use the production stack (https://matlab.mathworks.com/) for all the testing. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas To support your testing, we’ve highlighted several key areas of interest. While we ask that you report any efforts related to these areas, please note that testing is not limited to them. Submissions outside of these focus areas are equally welcomed and appreciated. Cross Site Scripting (XSS) Cross-Site Request Forgery (CSRF) SQL Injection (SQLi) Authentication related issues Authorization related issues Data Exposure Remote Code Execution Any vulnerabilities that allow a user to escape from the Docker container to the host operating system Particularly clever vulnerabilities or unique issues that do not fall into explicit categories Standards Persistent testing on any publicly facing functionality is not permitted. Any created content must be deleted within FIVE minutes. A non-exhaustive list of things to be careful about is: Contacting sales. Do not submit a bug report or contact technical or customer support. The service request feature of the MathWorks Account profile page will open service requests. Using this feature is prohibited by this brief. And again, anything that's publicly visible and persistent Any testing that results in temporary content being displayed must look normal to our regular site visitors and be non-malicious . Excluded Vulnerability Types The following finding types are specifically excluded from the bounty: Denial of Service attacks of any type. Open redirects (through headers and parameters) / Lack of security speedbump when leaving the site Internal IP address disclosure Accessible non-sensitive files and directories (e.g., README.TXT, CHANGES.TXT, robots.txt, gitignore, etc.) Social engineering/phishing attacks Self XSS Text injection Descriptive error messages (e.g., stack traces, application/server errors, path disclosure) Fingerprinting/banner disclosure on common/public services. Clickjacking and issues only exploitable through clickjacking. CSRF issues that don't impact the integrity of an account (e.g. login or out, contact forms and other publicly accessible forms) Email spoofing, lack of DMARC, SPF records, or DKIM configuration Lack of Secure and HTTPOnly cookie flags (critical systems may still be in scope). Login or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements HTTPS mixed content scripts. Username / email enumeration by brute forcing / error messages (e.g. login / signup / forgotten password). Exceptional cases may still be in scope (e.g. ability to enumerate email addresses via incrementing a numeric parameter). TLS/SSL configuration issues are not in scope unless they are egregious. Lack of pinning or allowing theoretically insecure cipher-suites is not in scope. Bugs that don't work in the latest version of Chrome, Firefox, Safari, IE11, and Edge Out-of-date software or use of a known-vulnerable component (exceptional cases, such as where you are able to provide proof of exploitation, may still be in scope) Lack of rate limiting on login, registration, or email generating forms. Attempt to overwhelm the LLM by sending an excessive number of requests in a short period (exceeding 25 within a minute), you may not receive the anticipated response and will be blocked. The presence of virus scanning on uploaded files Content admin pages present on the Internet. Security issues in 3rd party services, applications. Weak Captcha / Captcha Bypass Missing HTTP security headers, specifically (https://www.owasp.org/index.php/List_of_useful_HTTP_headers), e.g. Strict-Transport-Security X-Frame-Options X-XSS-Protection X-Content-Type-Options Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP Content-Security-Policy-Report-Only The following SSL Issues: SSL Attacks such as BEAST, BREACH, Renegotiation attack SSL Forward secrecy not enabled SSL weak / insecure cipher suites EXIF meta-data not stripped on images Out-of-scope for Stored XSS XSS vulnerabilities that follow the same steps across different file types or extensions will be considered duplicates and are out of scope for additional rewards. For example, using same payload in different file types and opening in different apps within MATLAB Online will be considered as duplicates. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

In Scope (in scope)

Target Overview This is a browser-based version of MATLAB . This platform gives users a MATLAB experience in a browser. As such, it is designed to execute user-supplied MATLAB code . This includes OS commands using the system() or network enabled functions in MATLAB. Executing MATLAB commands at the prompt or within a MATLAB program does not meet the standard for any "Server-Side Injection" vulnerabilities. We are interested in vulnerabilities that allow a user to execute commands as a privileged (root) user. MATLAB Online runs in a Docker container on a Linux host running in Amazon EC2. We are particularly interested in any vulnerabilities that allow a user to escape from the Docker container to the host operating system. The production environment for MATLAB Online is https://matlab.mathworks.com/ MATLAB Online has several features that contact MathWorks. For example, "Send feedback". Do not use these features to contact MathWorks staff.