MyFitnessPal Managed Bug Bounty

Description

MyFitnessPal is the #1 nutrition and food tracking app. We believe in community support and sharing techniques and successes! The security community is integral to helping keep our products and services safe for the users. This brief outlines steps for reporting vulnerabilities to us, what we expect, and what you can expect from us. We look forward to working with the security community to find security vulnerabilities in order to keep our business and customers safe. Program Rules Please read our entire policy page before you begin! IMPORTANT NOTE: COMMUNITY.MYFITNESSPAL.COM IS OUT OF SCOPE. The community forums are OUT OF SCOPE for this bug bounty program. Any posts, interactions, or other activities made in our community forums for the purpose of bug bounty testing are strictly prohibited. ANY TESTING OR REPORTS AGAINST COMMUNITY.MYFITNESSPAL.COM WILL RESULT IN PERMANENT REMOVAL FROM THIS PROGRAM. All authenticated activity on our platform must be conducted using a MyFitnessPal account linked to a @bugcrowdninja.com email address. Any activity as part of this engagement with MyFitnessPal linked to a non-Bugcrowd email address is strictly prohibited. Please provide detailed reports with reproducible steps and a PoC. If the report is not detailed enough with how the vulnerability can be leveraged, and how to reproduce the issue, the issue will not be eligible for a reward. When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced). Submit one vulnerability per report, unless you need to chain vulnerabilities to illustrate impact. Multiple attack paths that target the same underlying vulnerability will be awarded one bounty. Avoid in any way damaging, disabling, overburdening, impairing, interrupting, degrading, or impeding the normal use of our services. Do not delete or destroy any data. Refrain from any activities that are prohibited, that violate applicable laws (including privacy laws), or that are harmful to the rights and interests of others. If you encounter user information or any other personally identifiable information (e.g., names, device identifiers, etc.) during your testing please stop immediately and notify us through Bugcrowd. This information is and shall remain confidential. Further guidance will be provided along with an appropriate bounty for your finding. Please refrain from automated scanning against the domain. Do not engage in extortion. Do not leave any system in a more vulnerable state than you found it. Do not brute force user credentials or test credentials from public data disclosures. Social engineering attacks (e.g. spear phishing) are prohibited. Only interact with MyFitnessPal accounts you own. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Confidentiality By participating in this program you agree to keep any information you access or receive about MyFitnessPal (e.g., about MyFitnessPal systems, vulnerabilities, and the reports you submit) strictly confidential in accordance with the Standard Disclosure Terms and agree not to share such information with any third parties. Submission Requirements Summary of the bug Steps to reproduce Working proof of concept Impact is based on, but not limited to the following: How complex is the demonstrated exploit? How likely is it that this vulnerability could be exploited? Would an attacker economically benefit from exploitation? How many users can the exploit target at once? Is any private user data exposed? Is any confidential company data exposed?

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of MyFitnessPal not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not explicitly out of scope, but it demonstrably belongs to MyFitnessPal, you can report it to this program. However, be aware that it may only be awarded on a case-by-case basis. Target Information: Access: All targets are publicly accessible and the applications can be downloaded from the iOS and Android app store Credentials: To gain access to the application, please sign up for a MyFitnessPal account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . A one month upgrade to Premium or Premium+ can be granted upon request when needed for security testing, otherwise no credentials will be provided for this program. Please email [email protected] with the subject line “Upgrade Request for Bugcrowd” and provide your MyFitnessPal account(s) email and MyFitnessPal username. Temporary upgrades will only be provided to MyFitnessPal accounts created with @bugcrowdninja.com email addresses. Use account credentials that you are ready to share with the MyFitnessPal security team via Bugcrowd, so we can access the account during investigations if needed. Focus Areas: Application testing Website testing Out-of-Scope The following is a partial list of issues that we ask for you not to report: DoS / DDoS involving high request volumes Rate-limiting issues Public Zero-day vulnerabilities that have had an official patch for less than 1 month may be awarded on a case by case basis Reports of accounts that may have been compromised in the 2018 Under Armour/MyFitnessPal breach, including new large collections of accounts from collated breaches, are not in scope for this bug bounty program. For questions or concerns related to this event, please reach out to our support site or [email protected] Informational Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions Unauthenticated/logout/login CSRF Attacks requiring MITM or physical access to a user's device Open redirect - unless an additional security impact can be demonstrated Vulnerabilities only affecting users of outdated or unpatched browsers [Greater than 2 stable versions behind the latest released stable version] Clickjacking and issues only exploitable through clickjacking Issues that require unlikely user interaction Specific to Android Any URIs leaked because a malicious app has permission to view URIs opened Sensitive data in URLs/request bodies when protected by TLS User data stored unencrypted on external storage. Any kind of sensitive data stored in app private directory Dynamic code loading Runtime hacking exploits (exploits only possible in a jailbroken environment) Specific to iOS Path disclosure in the binary User data stored unencrypted on the file system Oauth "app secret" hard-coded/recoverable. Runtime hacking exploits (exploits only possible in a jailbroken environment). Safe Harbor: When conducting vulnerability research according to this policy, we consider this research conducted under this policy to be: Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy; Authorized in accordance with any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions of Use that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further. This safe harbor only applies to research conducted in accordance with this policy and only for targets listed as in scope (as specified in this policy).

Out of Scope (out of scope)

These targets are explicitly OUT OF SCOPE. ANY testing to these targets will result in IMMEDIATE AND PERMANENT REMOVAL FROM THE PROGRAM.