Personio

Description

Personio is Europe's leading HR Software for SMEs - your one-stop HR solution with automated processes, seamless integrations, and data-driven insights. Our Security Team knows that a solid Bounty Program helps build customer trust in our platform. So we are looking forward to working with you to help hold our platform up to the highest of standards.

Rules of engagement

By participating in this program, you agree to: * Respect the Community Code of Conduct * Respect the Intigriti Terms and Conditions * Respect the scope of the program * Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo) * Restrict your testing to your own sec-test- - environments #### Reporting vulnerabilities When reporting a vulnerability, please do your best to explain the vulnerability using clear, reproducible steps, which will help us validate the vulnerability as quickly as possible. Reports with a clear proof of concept, especially videos, are usually higher quality, which allow Personio to reproduce and fix vulnerabilities quicker, and that is why we will also be rewarding researchers submitting high quality reports additional amounts when deemed appropriate.

In scope

We are specifically looking for the following issues:

• Cross Tenant Data Leakage / Access
• RCE on Personio infrastructure
• Personio Production database access
• Personio Infrastructure access
• Sensitive Personio company financial or customer information publicly available

Conditional Scope — DoS / CPDoS

Denial of Service and Cache Poisoned Denial of Service (CPDoS) submissions are only in scope when they meet all of the following criteria:

1. Target: The affected service must be on *.app.personio.com. DoS/CPDoS against ancillary services (e.g., career pages, static assets, marketing sites) is out of scope.
2. Impact: The submission must demonstrate one of the following: - A single, small request (under standard size and rate) to an application endpoint that results in a full or partial application outage - An unintended large request (5,000+ characters) to an application endpoint that causes measurable service degradation or loss of availability
3. Escalation beyond availability: Submissions that demonstrate impact beyond availability (e.g., cache poisoning leading to data exposure, XSS via cached response, or authentication bypass) remain in scope regardless of the target asset.

Tiers

Tier 1 and Tier 2 assets are similar to what you can find in other bug bounty programs. The goal of Tier 3 is to motivate researchers to submit things that could harm Personio, even if they are not explicitly in the URLs listed in the other tiers. Although there are minimum bounties for the Exceptional and Critical severities, our goal for this tier is to reward using an impact-based approach, and we can bump the payout with bonuses if the impact of the reported vulnerability is extraordinary.

Include:

• Personio's Stackshare page: https://stackshare.io/personio/personio
• SLAs on verifying submissions: 10 working days

Out of scope

Customer and Other Tentants Testing must be strictly confined to your own sec-test- - environments. Accessing, interacting with, or sending requests to any other tenant, including and especially environments belonging to Personio’s customers, is out of scope and a violation of program rules. ## Community and Conversations * Any Low/Medium findings from community.personio.com. Only Critical/High accepted. * Any vulnerabilities or issues related to the Conversations product are out of scope for this program. ## Broken Access Control issues via uncommon Access Rights setups Broken Access Control issues via uncommon Access Rights setups that do not cross tenant boundaries and don't affect sensitive information, firstname / lastname / email address of employees in the same tenant are not considered sensitive. Other examples of non-sensitive information include, but not limited to: * E.g. Hide employee list, but find name of coworker in an API endpoint (not cross-tenant). * E.g. Remove access to Surveys, but are able to see a previous survey submitted in another area of the app. * E.g. Define an employee as "Terminated" or "Leave", which hides them in the Employee List, but are able to get their Name and previous position elsewhere in the app * E.g. Being able to use a feature of the app for a limited period of time when it was just disabled. ## The Following 3rd Parties are Out of Scope * Zendesk -> support.personio.de * Statuspage -> statuspage.personio.de * Slack -> personio.slack.com * Careers page -> personio.com/careers (please refrain from sending job applications that pollute our talent acquisition queue) ## #### Application * API key disclosure without proven business impact * Wordpress usernames disclosure * Pre-Auth Account takeover/OAuth squatting * Self-XSS that cannot be used to exploit other users * Verbose messages/files/directory listings without disclosing any sensitive information * CORS misconfiguration on non-sensitive endpoints * Missing cookie flags * Missing security headers * Cross-site Request Forgery with no or low impact * Presence of autocomplete attribute on web forms * Reverse tabnabbing * Bypassing rate-limits or the non-existence of rate-limits. * Best practices violations (password complexity, expiration, re-use, etc.) * Clickjacking without proven impact/unrealistic user interaction * CSV Injection * Sessions not being invalidated (logout, enabling 2FA, etc.) * Tokens leaked to third parties * Anything related to email spoofing, SPF, DMARC or DKIM * Content injection without being able to modify the HTML * HTML Injection that do not demonstrate a security impact * Username/email enumeration * Email bombing * HTTP Request smuggling without any proven impact * Homograph attacks * XMLRPC enabled * Banner grabbing/Version disclosure * Not stripping metadata of files * Same-site scripting * Subdomain takeover without taking over the subdomain * Arbitrary file upload without proof of the existence of the uploaded file * Blind SSRF without proven business impact (pingbacks are not sufficient) * Disclosed/misconfigured Google Maps API keys * Host header injection without proven business impact ## #### General * In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate * Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited * Spam, social engineering and physical intrusion * Distributed Denial of Service (DDoS) — Volumetric or amplification attacks of any kind are strictly out of scope and must not be tested * DoS requiring sustained or repeated requests to maintain impact (e.g., re-poisoning every cache TTL cycle) * CPDoS on CDN-cached public pages (e.g., *.jobs.personio.de, *.jobs.personio.com) * Any testing that degrades service for real users — use cache busters and isolated parameters * Credential stuffing and/or Brute Force * Vulnerabilities that only work on software that no longer receive security updates * Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts * Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty * Reports that state that software is out of date/vulnerable without a proof-of-concept

Severity

This program follows Intigriti's triage standards.

Here are some examples of vulnerabilities and how we match them to criticalities by applying the business modifier:

Exceptional

• Remote Code Execution
• Access to AWS Keys

Critical

• Access to all users or accounts
• User-account or account takeover
• Multi-tenant PII access

High

• Stored XSS (only cross-tenant)
• Access to one user or account
• Privilege escalation within the same account with account take-over or similar (making yourself admin, gaining access to salary info, …)

Medium

• Stored XSS (single-tenant)
• Reflected Cross-Site scripting with no or limited (1 step) user interaction
• Privilege escalation within the same account that exposes GDPR-protected data

Low

• Reflected Cross-Site scripting with user interaction
• Cross-Site scripting that does not work on either chrome, safari or internet explorer
• Full path disclosure with limited information

FAQ

Where can we get credentials for the app? Testers must create their own instances according to the format below using Trial instances at https://www.personio.com/free-trial/. The environments come preloaded with realistic user data and will be registered with the actual tester’s email address in advance of any bounty activity. Trial accounts are limited to a 14 day trial period and new accounts need to be created when these expire. Register with your @intigriti.me address Make sure you name your company in format: sec-test- - . This way, your own instance will have the following naming format for its URI: https://sec-test- - .personio.de/. For example, if your researcher handle is tom55, you can name your company sec-test-tom55-01 to sec-test-tom55-99. ### How can I change the app language to English? After creating a trial account, your account might be in German or another language you might not understand. This can easily be changed by following the instruction in this documentation page: https://support.personio.de/hc/en-us/articles/360004896117-How-do-I-change-the-language-of-my-Personio-account