REA Group | realestate.com.au, realcommercial.com.au, property.com.au

Description

REA Group is a digital business with more than 3,300 people working to change the way the world experiences property. We use new technology and our collective global knowledge to deliver the best products and services to our customers and consumers. Our global footprint covers three continents including Australia, Asia and North America. At REA the safety and security of our customers, consumers, and wider community are of utmost importance to us. We regularly review and update our security measures to keep up with changing technologies. As such we are looking for passionate and driven researchers who are excited to join us in our pursuit of securing homebuyers, renters, and agents alike. Good luck, and happy hunting! Good Behaviour Our real estate apps mean the world to our huge user base of families, individuals, real estate agents, brokers and many more. Please conduct your research in a safe manner by following rate limits and being wary of what you submit. Please adhere to the below instructions. Do not interact (DNI) with any other user, including but not limited to: renters, brokers, agents, property managers, REA employees, third parties, and others. This includes support and contact forms, and any ticketing systems. Do not rapidly submit forms (e.g., Burp Intruder, automated scripts) since these can have impact on our users. Use your Bugcrowd email when signing up. When submitting forms please ensure you include "Test" or "Bugcrowd" or similar, so people know it's for testing purposes. If you need to test attacks against other users, please create a secondary test account. Some sub-domains might have CNAME records to other domains, please remain in-scope and do not test products/brands which are not listed as in-scope. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized in accordance with the scoping information above. Cloud resources which are not associated with the hostnames listed in the scoping, but are demonstrably associated with REA Group will be considered for inclusion in this bug bounty program. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to REA Group, you can report it to our vulnerability disclosure program. However, be aware that such reports will be ineligible for rewards or points-based compensation. Focus Areas: PII extraction (excluding agency contact details) Corporate data extraction Access internal network access Do Not Interact Please DO NOT submit enquiry forms that may trigger contact with REA Group staff, real estate agents or brokers, employees and customers. For example any of our support or contact forms. Target Information A core function of our websites is the publishing of agent and agency contact information. These details are not sensitive and should not be considered as a security finding. We employ WAF and anti-bot/anti-scraping technologies across REA’s websites Our property listing data (property addresses, prices, features etc) is incredibly valuable and, whilst it is public and viewable by users, we do not permit that data to be scraped. If you see an “Error 429 – Too Many Requests” when accessing the website, particularly when using automated scripts or web proxies, this is an indication that our anti-bot/anti-scraping tool is blocking your client. A blank white screen (no content) is also displayed in this case and may indicate that the tool has interfered with your request. Viewing the target applications with a regular web browser should NOT trigger the WAF or the anti-bot measures. Please do not attempt to brute-force or use DoS techniques to overwhelm the WAF or anti-bot tooling, and always follow the RoE. Credentials All targets in scope follow a standard user registration process requiring an email address. SSO is used to allow users to login to many of our web apps using the same email address. To gain access, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here Out-of-Scope Submissions that are best practice or informational without a proven impact or PoC (e.g., HTTP headers). Please do not submit forms that may trigger contact with REA Group staff. For example any of our support or contact forms. Social Engineering and any interaction with REA Group physical locations, real estate agents or brokers, employees and customers. Volumetric brute-forcing (e.g., password spraying, credential stuffing, PIN code brute-force) Publicly-known zero-day vulnerabilities (e.g. CVE/GHSA) will not be considered for eligibility until more than 30 days have passed since patch availability. Excluded Submission Types Mail server issues (DMARC/DKIM/SPF) Rate limiting issues (DoS/DDos, brute force, credential stuffing etc.) Cookie flags (HTTPOnly, Secure, SameSite etc.) HTTP security headers Long-lived session tokens Client-facing API keys with minimal impact such as Google Maps localStorage/sessionStorage unless PII is clearly shown TLS issues such as TLS version and cipher suites (except SSL) Open redirect in authentication/authorisation/OAuth flows (known issue we are fixing) Absent/Defeatable SSL Certificate Pinning (Android/iOS) Root/Jailbreak detection (Android/iOS) App Crash (Android/iOS) Screenshots/Screen Caching Enabled (Android/iOS) Broken social media links and other moderation issues Leaked Credentials If you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd support portal before going any further.

REA Group - Corporate Website (in scope)

REA Group Corporate Website Our corporate website at rea-group.com provides information about our business including: What we do as a company including our history, our products and brands. Investor reports and stock information. News, media and press releases. Careers section. Findings we're interested in for this target: Accessing blog posts before they are published publicly (e.g., accessing investor information early). Vulnerabilities relating to the careers section (not including Workday - not in scope). REA Static This domain hosts our static assets such as JavaScript files and images. Directly accessing the website may show an error as the assets are usually hosted under subdomains. While navigating our other apps such as property.com.au and realcommercial.com.au you may see references to reastatic.net . Findings we're interested in for this target: Sensitive files located amongst static files. Non-static resources (e.g., dynamic web pages, debug/staging content).

REA Group - www.realestate.com.au (in scope)

Realestate.com.au At realestate.com.au our purpose is to empower people by making property simple, efficient and stress free. Whether you’re just beginning your property journey or have had years of experience, realestate.com.au is the number one place for people to come together to explore, research and share their passion for Australian property. With an average of over 12 million visitors each month across web and mobile we are the leading property resource in Australia. Whether you are looking for a share house, an investment property with a great rental return or possibly even inspiration for updating that living room, realestate.com.au is here to help you make better decisions for taking your next step. www.realestate.com.au is a website dedicated to Australian residential real estate. Users can search for properties to buy or lease, as well as look at properties that have already sold or been leased. By signing in with a free account, users can save properties for later and get notifications of property updates. Users cannot publish property listings for sale or lease, as this is only available to real estate agents who pay to advertise on the platform. Our mobile apps offer a mobile experience using the same APIs and backend systems as our primary site www.realestate.com.au

REA Group - Real Commercial (RCA) (in scope)

Real Commercial (RCA) Whether you’re looking for a commercial property, researching the market or looking for a commercial agent, find it all on Australia’s favourite commercial property site. With our foundations in property search, we also are one of Australia’s best destinations for news on the commercial property market, tips and guides to get you started, and stories of inspiring commercial property experiences. www.realcommercial.com.au is a website dedicated to Australian commercial real estate. Users can search for properties to buy or lease, as well as look at properties that have already sold or been leased. By signing in with a free account, users can save properties for later and get notifications of property updates. Users cannot publish property listings for sale or lease, as this is only available to real estate agents who pay to advertise on the platform.

REA Group - next.flatmates.com.au (Staging) (in scope)

Flatmates Flatmates is Australia’s No.1 share accommodation platform. Based in Melbourne, Australia, Flatmates.com.au allows people to list their spare rooms, find accommodation or team up with others to start a share house. We are Australia's largest share accommodation platform with a vision to create the best shared living experiences. We provide an online community where people offering accommodation can meet flatmates who are looking for a room to rent and a place to call home. Staging Environment Instructions Please Note: This is a staging environment, read carefully! The domain in-scope is next.flatmates.com.au which is the staging environment for this system. Do not test flatmates.com.au (production). If you accidentally touch production please stop testing immediately and double check your scope settings. Access You must provide the following HTTP header to access the environment: bugcrowd-id: flatmates-bugcrowd: E277D811-7BE0-4DC1-BDF8-C3B9394E5C69 Creating Listings In the staging environment all listings should be auto-approved if you register an account and verify with SMS-based OTP. Normally (in production) all listings are reviewed and approved before they 'Go Live' so please take that into consideration before raising issues. We have skipped that step in the staging environment to make it easier for you to test. Payment Information If payment is required for testing please use the following test card details: Card Number: 4242 4242 4242 4242 Expiry: 04/26 CVV: 424 Uptime The server has the following downtimes: 4:00 AM to 8:00 AM AEST: Server is unavailable 4:00 AM to 9:00 AM AEST: Search results are not available If the server is not working please try again later, this is a staging environment after all! Additionally the test database is wiped every night so you will have to re-create accounts, listings etc.

REA Group - Property.com.au (PCA) (in scope)

Property.com.au (PCA) Property.com.au is on a mission to help Australians find the full picture on every property. We leverage data from a range of publicly available sources and make it easily digestible for everyone – whether you’re renting, buying or selling for the first time, just curious about how your property is tracking, or a seasoned investor. www.property.com.au is a comprehensive platform for searching Australian residential real estate. Users can search and view for any property, even ones that are not currently listed for sale. Users can browse detailed property listings, view photos, read property descriptions, and access information about local areas. Note that only www.property.com.au domain is in-scope for PCA.

REA Group - mortgagechoice.com.au (in scope)

Mortgage Choice For 30 years, Mortgage Choice has helped Australians finance their homes, investment properties, cars and businesses by delivering a range of choices with a team of trusted experts. Mortgage Choice is part of our family at REA Group, helping Australians navigate the home loan process with confidence. Through our network of expert brokers, we connect people with lending options that suit their needs and goals. Production Environment Instructions We are allowing researchers like yourself to test our production environment for Mortgage Choice but there are some caveats in addition to the out-of-scope section. Do not make any bookings ("Book An Appointment") via our Ubookr, Calendly, Acuity, Mystro, or other third-party integrations. Do not submit any 'Contact us' forms, especially to actual brokers. Please do not submit the following types of issues for this target, as they are already known issues we are actively remediating: Broken social media links and other moderation issues.

REA Group - developersites.com.au (in scope)

Developer Sites hosts content created by the marketing team within the Developer line of business. These landing pages and campaigns are designed to collect contact details from prospective clients, and pass these along to property developers. The system handles PII, so care should be taken when any exploitation is attempted. Production Environment Instructions We are allowing researchers like yourself to test our production environment for DeveloperSites but there are some caveats in addition to the out-of-scope section. Form submissions MUST be made from the in-scope testing URL paths so that they do not disturb paying customers (property developers). Catpure Leads API Submission The data.relationships.capture-campaign.data.id property for the capture leads API MUST be set to ca153ac6-2f5b-4769-bd80-74b9c7f84878 Agent Contact API Submission Submissions MUST be sent to the following URL: https://agent-contact.realestate.com.au/lead-capture-page/campaign-id/8e50c3d0-0d2b-44d1-9df6-f4e02b9a690e No other path on this hostname should be used while testing.

Out of Scope - www.rea-group.com (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

Out of Scope - www.realestate.com.au (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

Out of Scope - Real Commercial (RCA) (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

Out of Scope - Property.com.au (PCA) (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

Out of Scope - Other REA brands (out of scope)

These are other brands owned by REA, though are not currently in scope of our Bug Bounty program. Any submissions against these targets will not be accepted, even if they are reachable via an in-scope target.

Out of Scope - Flatmates (Staging) (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

Out of Scope - Mortgage Choice (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

Out of Scope - Developer Sites (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.

REA Group - Proptrack.com.au (in scope)

At PropTrack, our purpose is to help businesses make better property decisions through trusted data, digital valuation solutions and predictive analytics. PropTrack provides cloud-based valuation platforms, digital assessment tools and property data access for customers across banking, mortgage broking, valuations, government, telecommunications and utilities. PropTrack is used by organisations that need fast, reliable property information and workflows across the property lifecycle, including customer acquisition, valuation ordering, digital assessment and portfolio management. Customers use PropTrack to order and manage valuations, access property reports and data, understand local market activity, and support lending, planning, retention and operational decisions.

Out of Scope - proptrack.com.au (out of scope)

Please do not test out of scope targets as they may be: Third party vendors and SaaS products which have not consented to security testing, OR Experience after login, OR Links which are likely to breach the do-not-interact (DNI) clause of this programme.