Pantheon

Description

Pantheon is the professional website platform that gives Drupal and WordPress developers everything they need to build, launch, and run solid websites. We maintain customer privacy, security, and site availability as primary responsibilities of our operation, preferring defense in depth over reactive solutions. We strive to stay abreast of the latest state-of-the-art security developments by working with security researchers. We appreciate the researchers' efforts to help create a more secure Internet.

Targets

Introduction Pantheon is the WebOps platform people trust to host their Drupal and WordPress sites, so we take security and privacy very seriously. If you are a security researcher and have discovered a security vulnerability in the product, we appreciate your help in disclosing it to us privately and giving us an opportunity to fix it before publishing technical details. Scope The target for this program is dashboard.pantheon.io which is the company's production environment. Testing is only authorized on targets listed as In-Scope. Any domain/property of Pantheon.io not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you’re identified a vulnerability on a system outside the scope but demonstrably belongs to Pantheon, please reach out to [email protected] before submitting. It is appreciated but note that it will be marked as “not applicable” and will not be eligible for monetary or points based compensation. Please Read the Guidelines section before running tests Target Information The target for this program is dashboard.pantheon.io which is the company's production environment. All other subdomains are out of scope. Reports should only reference accounts owned by the researcher. Researchers can sign up for a trial account using the instructions below. Guidelines *Reports that carry an acceptable risk but demonstrate a valid security-related behavior will be closed as informative. Submissions that don’t present a security risk, are false positives, or are out of scope will be closed as N/A. If the attack/vulnerability does not pose a significant risk to the organization and is of a more informational nature, no bounty will be rewarded You are prohibited from: Executing or attempting to execute any Denial of Service attack Use of automated application scanners (OWASP Zap, Burp Suite) in attack mode. Attacking or exploiting accounts not created by you. Conducting any form of social engineering attacks against Pantheon staff. Cache poisoning attacks Exceeding a rate limit of 1 request per second for all scripted / API tests. Attempting to upgrade your trial account to a higher subscription without payment. Knowingly posting, transmitting, uploading, linking to, sending or storing any malware. Testing third party applications or services that integrate with or link to Pantheon. Attempting to rename a trial or paid account to another Pantheon customer domain Limit scripted / API tests. They must be rate limited to 1 request per second Add a header to your requests when possible Register for free accounts when testing Cross-account access may only be attempted between accounts controlled by you. All communication with Pantheon should ideally be done via the BugCrowd platform. Testing test/dev/live.pantheon.io sites. Remember to ONLY test on free trial sites that you created yourself Bounty Ineligible Issues Self-xss attacks (even against yourself) is outside the scope of the program XSS on pages where admins are intentionally given full HTML editing capabilities, such as custom theme editing Clickjacking Cookie flags SPF, DKIM, DMARC issues HTML Injection is an accepted risk unless you can escalate to XSS EXIF information on images Sandbox and subdomain takeovers (unless demonstrated sensitive information then it may be accepted on a case by case basis) Team/organization read-only privilege escalation Do not attempt cache poisoning attacks Do not submit reports of SSL/TLS best practice Do not submit reports of missing header (unless chained together to create an exploit) Do not submit reports of logout Cross-Site Request Forgery (logout CSRF) Do not submit reports of the presence of application or web browser "autocomplete" or "save password" Do not submit reports regarding a lack of email verification Do not submit reports of Wordpress or Drupal issues or vulnerabilities Reports of discrepancies between documented and actual workspace-level role permissions are out of scope unless they demonstrate a clear, real-world security impact. Report Formatting Please include the following information with your submission: -Vulnerable URL - the endpoint where the vulnerability occurs -Vulnerable Parameter - if applicable, the parameter where the vulnerability occurs -Vulnerability Type - the type of the vulnerability -Steps to Reproduce - step-by-step information on how to reproduce the issue -Screenshots or Video - a demonstration of the attack -Attack Scenario - an example attack scenario may help demonstrate the risk and get your issue resolved faster. Sign Up Process To sign up for a Pantheon Trial Account, please use the email you used to register with BugCrowd. For Company name please use BC-username-nn, where nn is an integer, if you need to create a new account after the trial period has ended. Trial accounts can be created here You may sign up for an account using your personal email address but we prefer if you sign up using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

Additional information

This bounty requires explicit permission to disclose the results of a submission.