Sophos

Description

Program Overview At Sophos, we understand the effort that goes into security research. To show our appreciation to researchers, who help keep our products and our customers safe, we are glad to introduce a Responsible Disclosure Program to provide recognition and rewards for responsibly disclosed vulnerabilities. Sophos rewards the responsible disclosure of any identified and confirmed security vulnerability that could be used to compromise the confidentiality, integrity, or availability of Sophos products, as well as services and infrastructure impacting Sophos' or users' data. In general no credentials or product keys will be provided for this program - all testing is to be performed using self-provisioned credentials against legally obtained Sophos products, including free trials. See the section Credentials for more details. The severity of submissions will be determined using CVSSv3.1 according to Sophos' internal standard.

Targets

Research Researchers should use test accounts (cf. Credentials below) or test systems where possible, such that the security and privacy of real users is protected. At all times, make a good faith effort to avoid privacy violations as well as destruction, interruption or segregation of Sophos services. Do not modify or destroy data that does not belong to you. Potentially destructive tests, including denial of service, require prior written consent by Sophos. Reach out to [email protected] , if a potentially destructive test on a production system is required to confirm a finding. Denial of Service testing against Sophos Central is explicitly prohibited and will not be approved at this time. Reporting Rewards or recognition require that the Sophos security team can reproduce and verify an issue and that the security impact is clear. Reproduction steps need to be clear, and may include screenshots, videos, scripts, etc. DO NOT use the output from automated scanners and tools as the entire vulnerability report. Rewards Rewards will be provided according to the rules of this bug bounty program as outlined above. At the discretion of Sophos, quality, creativity, or novelty of submissions may modify payouts within a given range. In case of multiple reports about the same issue, Sophos will reward the earliest submission, regardless of how the issue was reported. Issues in Security Features Reports about bugs or limitations in Sophos product security features, such as the ability to bypass a particular filter, are out of scope for the Sophos Bug Bounty Program and not eligible for rewards upon acceptance. Valid reports about novel security feature bypasses will be forwarded to the respective product team for review. At the sole discretion of the Sophos Product Management team, individual reports like these may be rewarded on a case by case basis. False negatives (undetected malware) are excluded from the program. However, we encourage you to submit any false negatives via https://support.sophos.com/support/s/filesubmission or email to [email protected] . Responsible Disclosure Sophos takes responsibility for disclosing product vulnerabilities to customers. To encourage responsible disclosure, we ask that all researchers comply with the following Responsible Disclosure Guidelines: Allow Sophos an opportunity to both correct and disclose a vulnerability first (including any CVE, if applicable) within a reasonable time frame. Allow Sophos' customers 30 days to install the security patch before disclosing vulnerability details to anyone. Coordinate with Sophos on any publication of vulnerability details. Sophos advises its customers that those who exploit security systems often do so by reverse engineering published security updates, and therefore encourages its customers to patch timely. For the full responsible disclosure policy, please refer to and comply with the Sophos Responsible Disclosure Policy . Reward Eligibility Current employees or contractors of a Sophos Group entity are not eligible to participate in the program. Former employees and contractors are eligible to participate in the program only, if they have left the Sophos Group entity more than 1 year prior to submission, and they are not making use of, or referring to, any non-public Sophos information obtained when they were an employee or contractor. Credentials Testing Credentials For testing services and products that require credentials, please create an account on your own using your @bugcrowdninja.com email address. Your bugcrowdninja email address is your username @bugcrowdninja.com . All emails will go to the email address associated with your account. In all cases, ensure that the term bugcrowd is part of your testing account. If for some reason your IP address or account are banned during your research activity, please contact us at [email protected] and we'll restore your access ASAP. Credential Leaks Reports about leaked credentials, included but not limited to user names, passwords, cookies, tokens, etc., are not eligible for reward unless steps are provided on how they can be acquired from a system under direct Sophos control. LEGAL By engaging or participating in this bug bounty program, you agree to treat the following types of information as Sophos’s confidential information and not divulge to any third person (except disclosure to Sophos through the Bugcrowd platform) any such information until disclosure is approved in writing by Sophos: (i) all information you receive or collect about Sophos and its products, or any of Sophos’s customers during your participation in this program; and/or (ii) vulnerability report and any vulnerability. Disclosure of Sophos’s confidential information to any third parties before Sophos’s approval forfeits the reward and could disqualify you from participating in this bug bounty program in the future. Please notify Sophos immediately upon discovery of any loss or unauthorized disclosure of confidential information. You must notify Sophos immediately if you: (i) gain access to another person's accounts or data; (ii) destroy any data, or (iii) cause interruption or degradation of Sophos’s infrastructure and services. Additionally, if you encounter personally identifiable information, customer data or other sensitive information, please contact Sophos immediately, and do not retain any copies of such information. By submitting your vulnerability report, you perpetually allow Sophos and its affiliates and subsidiaries the unconditional ability to use, modify, create derivative work from, distribute, publish and display information provided in your report or to have others do the same on Sophos’s behalf, and these rights cannot be revoked. Sophos cannot provide a reward if you’re a minor, on a sanctions list, or live in a country that is on a sanctions list. You must comply with all applicable laws in connection with your participation in this program. As a participant in this program, you will not be deemed to be in breach of applicable Sophos license provisions so long as your actions are consistent with this bug bounty brief.

Intercept X Endpoint (Windows) Special Target (in scope)

Sophos Endpoint Protection is a multi-component system where some parts run at the highest possible privilege. One of the design goals is to protect users of the endpoint from threats on the network, therefore remote compromise of Endpoint Protection components is of particular concern to Sophos. Attacks meeting ALL of the following conditions are eligible for consideration of a maximum bounty of $80,000: triggering execution of attacker-controlled code in a high privilege context (Administrator or higher for Windows) doing so remotely doing so via Endpoint Protection components no user interaction is necessary Clear instructions for how to reproduce the finding are required. Some examples of in and out of scope scenarios follow. These are intended to illustrate the above definition, not to limit it. Attacks that meet the definition will be in scope. Examples: In-scope examples (all must lead to the attacker able to act as Admin, with no user interaction): Direct exploitation via an exposed port associated with an Endpoint Protection component. Target machine receives an email from attacker triggering RCE due to Endpoint Protection processing / parsing. A browser on the endpoint visits a webpage leading to code execution due to Endpoint Protection interactions with the browser or associated network traffic. Out-of-scope examples: Code execution after connecting via an authorized remote route, e.g. RDP. This is not considered a remote exploit since the RDP connection gives the attacker a presence local to the target. Any attack where a user needs to enter credentials. Attacks where user interaction is required are excluded from this bounty target. Any attack where code execution is obtained but not in the context of Admin. All testing can be done with free trial versions https://www.sophos.com/en-us/products/endpoint-antivirus/free-trial of the product on the Windows platform. IMPORTANT. All research should be done on fresh trial versions of Intercept X and when signing up for the trial, ensure your email has bugcrowdninja in the address. For example, [email protected] or [email protected] Eligible findings are reproducible on fully patched installations of Intercept X. Sophos will not reward issues that are not reproducible in the latest release. Testing should be done on 64-bit Windows only, Windows 10 22H2 (build 19045) or later Windows 11 22H2 (build 22621) or later.

Sophos Central Special Target (in scope)

Sophos Central is an integrated management platform that enables customers to effectively utilize and oversee the capabilities and synergies of the Sophos products installed in their environments. Additionally, it facilitates the configuration of hosted services designed to safeguard customer assets. It is crucial to prioritize the protection of customer data and other valuable assets at all times. The following categories of issues, which could significantly impact both Sophos customers and the company itself, are eligible for the highest payout if all the respective requirements are met: Large-scale data breach with potential regulatory disclosure requirements Involving thousands of customer accounts without relying on brute force methods, and Affecting legally relevant customer data, such as high-risk Personally Identifiable Information (PII) Complete, zero-touch, super-admin account takeover Impacting a broad range of super-admin accounts, and Not requiring any user interaction, and Originating from Sophos, rather than a third-party Identity Provider (IDP) Demonstrating full or partial administrator-level access to Sophos production public cloud infrastructure by modifying AWS resources or configurations, particularly those related to Identity and Access Management (IAM) Demonstrating privilege escalation by writing arbitrary files on a compute instance outside of legitimate use cases All testing can be done with free trial accounts on Sophos Central. Reports must include clear steps for reproducing the issue. IMPORTANT. All research should be done on fresh trial accounts and when signing up for the trial, ensure your email has bugcrowdninja in the address. For example, [email protected] or [email protected] .

Sophos Firewall Special Target (in scope)

Sophos Firewall is a next-generation firewall and comprehensive network security platform. It frequently serves as the primary line of defense against threats targeting local networks and their users, placing it under significant scrutiny. Findings of critical severity issues that are exploitable at large scale are eligible for the highest reward. Reports are/come with: Attack Vector: Network (WAN interface only) Attack Complexity: Low (no MitM etc.) Privileges Required: None (pre-auth only) User Interaction: None (no phishing, etc.) Impact: Code/command execution as root (CVSSv3+ C:H/I:H/A:H) Reproducible on the latest maintenance release of the latest version, as published on MySophos Detailed version information: Login to the Device Console At the console> prompt type: “system dia sh ver” Add the output to the report (screenshots accepted) PoC code or step by step reproduction instructions May be in the form of a video Tools used to detect the issue, if any Information on what helped discover the issue most: Root shell access Reverse engineering (decompiled JARs) Previously published CVE (incl. CVE ID) Other (please elaborate) Source code file and line of the issue, if possible Sophos will leverage existing configuration telemetry to assess the probability of an exploit being effective on a large scale. When more than 95% of all devices are proven to run a non-exploitable configuration, the threshold of this target is not met, and the regular reward structure applies. All testing can be done with free trial versions of the product on any available platform (software/virtual/hardware). IMPORTANT. All research should be done on fresh trial versions and when signing up for the trial, ensure your email has bugcrowdninja in the address. For example, [email protected] or [email protected] Eligible findings are reproducible on fully patched installations of XG Firewall (see https://community.sophos.com/kb/en-us/135415 for details). Sophos will not reward issues that are not reproducible in the latest release.

Premium Bounty Eligible Targets (in scope)

Eligible findings are/come with: Reproducible on the latest maintenance release (MR) on an actively maintained product branch that is generally available (GA) Detailed version information All testing can be done with free trial versions of the product on any available platform (software/virtual/hardware/operating system) as applicable. Please refer to our release notes for product updates.

Bounty Eligible Targets (in scope)

The Sophos "catch-all target" is a way to report any other issue not covered by the Premium or Out of scope targets: receive rewards for P1 findings Kudos points for all accepted submissions