TheFork Managed Bug Bounty Engagement

Description

TheFork, also known as La Fourchette, is a premier real-time restaurant reservation platform, providing users with access to over 60,000 dining establishments across various countries, including France, Spain, Switzerland, Belgium, Italy, Sweden, and many more. TheFork empowers users to discover and book restaurants at any time, ensuring seamless access to a diverse range of dining experiences, from casual meals to gourmet dining, all at the best available prices. With an extensive and growing database of over 20 million verified user reviews, TheFork helps diners make well-informed decisions by offering insights into restaurant quality, service, ambiance, and pricing. Whether users are looking for a local favorite or an international hotspot, TheFork’s intuitive platform simplifies the process of finding and securing reservations, catering to both spontaneous and planned outings. Beyond simply offering a reservation service, TheFork is designed to enhance the overall dining experience by providing users with exclusive offers, discounts, and promotions at selected restaurants, making dining out more accessible and affordable. Additionally, the platform includes a loyalty program that rewards frequent users with points (Yums) that can be redeemed for discounts on future reservations. This program specifically focuses on testing TheFork’s B2C website and mobile app, ensuring that the platform remains secure, reliable, and user-friendly. Regular testing helps to maintain a high standard of performance and user experience while safeguarding the platform from potential vulnerabilities, ensuring that both diners and restaurant partners continue to benefit from a seamless and trusted service. Good luck, and happy hunting! General Program Rules (please read carefully) Violating program rules may result in your bounty being omitted. USE ONLY TEST RESTAURANTS. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban. Identify your activity as belonging to Bugcrowd, whether you are performing manual testing or using automated tools: Include the string "bugcrowd" in your User-Agent Add "bugcrowd" to one of the fields of any form post not requiring account information Do not contact other customers / users of the site. Do not attack or interact with any user account that you do not expressly own. Limit excessive automated testing. Automated testing should not exceed 25 requests / second. Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy (please see below for any exceptions). However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of TheFork not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to TheFork, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation. General Program Rules (please read carefully) Violating program rules may result in your bounty being omitted. USE ONLY TEST RESTAURANTS. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban. Identify your activity as belonging to Bugcrowd, whether you are performing manual testing or using automated tools: Include the string "bugcrowd" in your User-Agent Add "bugcrowd" to one of the fields of any form post not requiring account information Do not contact other customers / users of the site. Do not attack or interact with any user account that you do not expressly own. Limit excessive automated testing. Automated testing should not exceed 25 requests / second. Access Consumer Platform (B2C) Access Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Test Restaurants : 500 test restaurants are ready to be used for testing. You can find the complete list in the program resources section on Bugcrowd platform. Payment Testing (TFPay) Payment functionality in TFPay only opens for the specific booking once your dining time has started and stays open for a maximum of 3hrs To perform test payments, you must have logged in to the mobile app with an @bugcrowd.com or @bugcrowdninja.com email account Navigate to TheFork pay section through the menu in the app, add test credit cards & gift cards or select the relevant booking Complete the payment. Note a maximum of 2 payments per reservation is allowed Customer Semi-logged Information TheFork allows booking only with an e-mail address + First name + Last name + Phone number Email addresses and phone numbers are not validated for ownership It's possible to know if an e-mail address is registered or not in TheFork It's possible to book with an e-mail address you don't own Business Platform (B2B) Access Use credentials provided by TheFork inside the file Please DON'T change the restaurant password Technical Notes (B2B) JWT TTL is 5 minutes. Session invalidation occurs 5 minutes after logout or password reset API testing should be performed from a black box perspective (no documentation available) Redirection to out-of-scope domains (.theforkmanager.com) may occur during authentication, but testing should remain within listed scope For some actions the platform requires an OTP sent to the restaurant email address. We are working on providing a static OTP that can be used to test those functionalities. Reporting Submissions should include full HTTP request and response Submissions should contain demonstrated practical impact and attack scenario Final decisions on vulnerability priority and bounty amount are made by TheFork security team for each report individually Reward Classifications Developer Portal (developer.thefork.io) : All security issues will be ranked as P4 Cross-Platform Issues : Vulnerabilities affecting both B2C and B2B systems may receive higher priority consideration Legacy vs Primary Systems : Primary APIs receive standard rewards; legacy systems may have reduced rewards Focus Areas Consumer Platform (B2C) Specific Account & Authentication: User account manipulation and privilege escalation Authentication bypass and session management Password reset functionality Permissions and authorization flaws Payment & Features: Credit card processing and storage Pay at the table (TFPay) functionality Giftcard handling and validation Yums loyalty system vulnerabilities Common Web Vulnerabilities: XSS, CSRF, IDOR, SQL/NoSQL Injection JWT and GraphQL implementation flaws PII (Personally Identifiable Information) exposure Access to internal infrastructure & corporate tools Business Platform (B2B) Specific User account manipulation and privilege escalation Authentication PII (Personally Identifiable Information) exposure JWT and GraphQL Cross-Platform Security Data leakage between B2C and B2B systems Privilege escalation from B2C to B2B or vice versa Shared authentication vulnerabilities Cross-platform data exposure Important Testing Notes What's Considered Expected Behavior (Not Vulnerabilities) Customer Data Model: The following behaviors are intentional design choices and are not considered security vulnerabilities. Reports relying solely on these behaviors - without demonstrating additional impact or unauthorized access to non-public data - will be closed. Booking Flow: The booking process requires only an email, name, and phone number. Ownership verification is not performed. It is expected that users can submit details they do not own, and it is expected that email addresses can be checked for registration status. System-Generated Data: When viewing system-level customer profile or booking information (e.g., via internal booking management tools), data is intentionally obfuscated (first initial of first/last name, partially masked phone number, Yums balance). Exception for User-Generated Content: This policy regarding obfuscation does not apply to public-facing content that users voluntarily publish, such as public restaurant reviews. Disclosure of first names within publicly viewable reviews is intended functionality. We are interested in vulnerabilities that allow the mass extraction of non-public PII, not the collection of information that users have intentionally chosen to make public on the platform. Session Management: 5-minute delay for session invalidation after logout/password reset is expected Weak password policies are not considered vulnerabilities Temporary Classifications: IDORs : Currently ranked as P5 Informational (for B2C, B2B is ranked as usual) BACs : Currently ranked as P5 Informational (fix in progress) Exclusions Session invalidation can take 5mins when user logout or reset his password Weak Password Policy All lafourchette.com domains are out of scope (api.lafourchette.com, Review-api.lafourchette.com, M-api.lafourchette.com, etc.) Other TheFork brand domains are out of scope (www.lafourchette.com, www.eltenedor.es, www.thefork. variants not explicitly listed) DoS / DDoS attacks of any kind Social engineering attacks of any kind Exploits around mass content submission, account creation or spamming Content fraud - example: inflating or deflating a restaurant's rating, or raising a review's helpful vote count Lack of rate-limit Exploits that require warranty voiding actions (e.g., rooting victim device) Exploits against the site from webviews within mobile applications NOT published by TheFork Mobile application vulnerabilities that require having a malicious application installed will have drastically reduced priority class because of prerequisite HTTP Header security related findings such as missing headers Information-stealer logs / exposed credentials that has no access to the internal resources. Please note that, info-stealer logs may be accepted if the detected credential can be used for accessing internal resources. Domains that do not send email are not eligible for rewards relating to email misconfiguration (e.g. DMARC misconfiguration) SSL related issues are out-of-scope All vulnerabilities related to 3rd parties outside of TheFork. Example - Stripe, Amilon All findings regarding hijacking of 3rd party or any domain / social media in which TheFork is not the direct responsible (Social Broken Link) Contacting or requesting customer support services (e.g. phone support, support chat, email support). If you have questions while testing, refer to the TheFork FAQ Page or contact Bugcrowd Support . IDORs are temporary going to be considered as P5 Informational. We are aware of an issue linked to such vulnerability, the fix is in progress. BACs are temporary going to be considered as P5 Informational. We are aware of an issue linked to such vulnerability, the fix is in progress. All findings regarding hijacking of 3rd party or any domain / social media in which TheFork is not the direct responsible (Social Broken Link) will be ranked as INFORMATIONAL. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

B2B (in scope)

Website manager.thefork.com This is the B2B version of TheForks' Business to Business web application. USE ONLY TEST RESTAURANTS. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban. API Testing The API sitting behind the application is in scope, however, no documentation is available for it. Please test it from a black box perspective. Notes JWT TTL is 5mins. For example: if you logout, your session is invalidated after 5mins. If you reset password, all sessions are disconnected after 5 minutes. Redirection to an Out-of-Scope domain (*.theforkmanager.com) may occur. Although this may happen while authenticating, the below-listed scope is specific to this program and should be followed when testing & submitting reports.

B2C (in scope)

Website https://www.thefork.com - This is the B2C version of TheForks' Business to Consumer web application. Researchers are invited to test the full functionality of this application, both from the logged in and anonymous perspective. Booking Restaurants IMPORTANT: When booking reservations, please ONLY USE THE TEST RESTAURANTS PROVIDED BELOW. It is imperative to understand that testing on live production restaurants or their systems is strictly prohibited without exception. Failure to adhere to this policy will not be tolerated and will result in program ban. List of 500 test restaurants Spanish Restaurant Italian Restaurant French Restaurant These restaurants can't be found through search field, please go directly through the link. Payments Make a reservation with your @bugcrowd.com or @bugcrowdninja.com account as close to the time of your test as possible. Bookings can be made through the B2C website or mobile apps on one of the test restaurants. Payment functionality in TFPay only opens for the specific booking once your dining time has started and stays open for a maximum of 3 hrs To be able to perform test payments, you must have logged in to the mobile app with an @bugcrowd.com or @bugcrowdninja.com email account Navigate to TheFork pay section through the menu in the app, add a test credit card & gift cards or select the the relevant booking, then add your test credit card & gift cards Complete the payment. Note a maximum of 2 payments per reservation is allowed. Navigate to TheFork Pay section to verify the status of the payment API Documentation https://api.thefork.com https://google-reserve-api.thefork.io

B2C Low reward (in scope)

Tools All of our tools are under *.tools.thefork.tech, some of them are reachable only internally.