ownCloud

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Discretionary; paid on the initial report once ownCloud confirms the finding at CVSS 7.0 or higher, with no published ceiling │ not published │ not published Submit a vulnerability CVE history 7 Last 12 months 177 Lifetime Access control 35 % Info disclosure 30 % Auth bypass 20 % Injection 10 % Latest advisories Loading the feed Overview ownCloud is the original self-hosted file sync and share platform — the project Nextcloud forked away from — and it is still deployed across European universities, research institutes and public administrations, with something on the order of 58 million Docker Hub pulls behind it. What it holds is the point: an ownCloud instance is the document store for an entire organisation, reachable from the internet by design, so an access-control or authentication failure is a bulk data-protection incident rather than an outage. CVE-2023-49103, the graphapi phpinfo disclosure, was mass-exploited in the wild and is a fair proxy for how exposed that install base is. The money here is real but conditional and unquantified: ownCloud runs two private, invite-only YesWeHack programs, one for ownCloud 10 and one for Infinite Scale, and the published route in is to file a HIGH or CRITICAL finding through the public VDP with your YesWeHack username in it — "If we confirm the finding at CVSS 7.0 or higher, you will be invited to the corresponding program and receive a bounty for the initial report." No amount appears anywhere, the private programs are invisible to every public API, and the $25,000 Kiteworks engagement does not reach any ownCloud asset, so there is no ceiling to quote and we will not invent one. Agree a figure before you count on it. sorona.xyz adds 1.25× on top of whatever ownCloud awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope ownCloud states the target as two products: "we run two private, invite-only bug bounty programs on YesWeHack: one for ownCloud 10 and one for ownCloud Infinite Scale." The public VDP at security.owncloud.com is the way in, and payment turns on ownCloud confirming the finding at CVSS 7.0 or higher ownCloud 10, the AGPL-3.0 PHP server: its core, the WebDAV stack, and the OCS APIs the desktop and mobile clients talk to Sharing on ownCloud 10 in every flavour it ships: user and group shares, public links with and without passwords, and federated shares to other instances Authentication and session handling on ownCloud 10, including the user backends and SSO integrations for LDAP, SAML and OAuth2, and the app passwords issued to clients Storage on ownCloud 10: the file cache, the external storage connectors, and the server-side encryption module The apps ownCloud ships with the server, and the admin settings that configure the server and those apps ownCloud Infinite Scale, the Apache-2.0 Go rewrite: its service set, the proxy that fronts it, and the authentication middleware inside that proxy Identity and authorisation on Infinite Scale: the OIDC identity provider, the graph API, and the sharing and public-link services The Infinite Scale storage providers underneath those services, and the web front end on top of them Out of scope Anything ownCloud confirms below CVSS 7.0, which earns no bounty and no invitation regardless of how interesting it is Reports filed without a YesWeHack username named in them, since the invitation is issued against that account and the payment follows the invitation Findings shared with a third party before ownCloud gives written permission, because the policy declares everything a researcher obtains or generates about its products an ownCloud trade secret Nextcloud, which forked away from ownCloud and runs its own separate program on its own code Community apps and third-party ownCloud marketplace apps, which are named in neither private program and should be assumed unpaid The paused HackerOne program at hackerone.com/owncloud, which is not the live route and will not produce an award Most-valued findings Pre-authentication remote code execution or authentication bypass on the ownCloud 10 or Infinite Scale server. It is the clearest route past the CVSS 7.0 gate that everything on this page depends on, and below that gate nothing pays at all Cross-tenant or cross-user file access through sharing, public links or federation, where one user reaches another organisation's documents; access control is 35 percent of this project's CVE record for a reason Unauthenticated information disclosure of files, credentials or configuration from a default install, the class CVE-2023-49103 fell into and the one that gets mass-exploited when it lands Privilege escalation from an ordinary account to an administrator, which converts a single compromised login into control of the whole document store Findings reproduced on a stock, default-configuration deployment rather than one you had to weaken, because a weakened configuration will not survive ownCloud's own CVSS assessment Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The finding has to be HIGH or CRITICAL and ownCloud has to confirm it at CVSS 7.0 or higher: anything below that pays nothing and buys no invitation into the private program You must already hold a YesWeHack account and name the username in the VDP report, because the invitation is issued against that account The same policy states you are making your report without any expectation or requirement of reward, which sits in open tension with the bounty commitment on the same page and is why confidence in this pathway is low To the extent you suggest changes or improvements in your report, you assign ownCloud all rights of use and ownership of those suggestions Publication after a fix requires one month's notice, and identifying ownCloud in a writeup is only possible after they have given explicit approval The old HackerOne program at hackerone.com/owncloud is paused and must not be used; the live route is the VDP at security.owncloud.com Disclosure Coordinated through ownCloud's own VDP, and unusually tightly held: the policy bars disclosing confidential information including the details of your own submission without ownCloud's prior express consent, requires a month's notice before publication after a fix, and requires explicit approval before you may name ownCloud at all. Treat the timing as ownCloud's decision rather than yours. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability