Tyler Technologies Data & Insights – Tyler Data Platform, powered by Socrata

Description

Tyler Technologies Data & Insights helps public sector organizations improve transparency, citizen service, and data-driven decision-making. Our user-friendly solutions deliver data to governments trying to reduce costs, to citizens who want to understand how their tax dollars are used, and to civic hackers dedicated to creating new apps and improving services. We take the security of our systems seriously, and we value the security researcher community. The disclosure of security vulnerabilities by security researchers helps us ensure the security and privacy of our users and makes the Web a safer place for all. Because our platform is built for data sharing it is worthwhile for researchers to familiarize themselves with the account permission models in place and especially with our Socrata Query Language (SoQL). A note on SoQL : SoQL is a read-only, public query interface available on open data endpoints. It supports filtering, sorting, and arithmetic through URL parameters like $select, $where, and $query. These are intentional platform features, not vulnerabilities. Before submitting any injection-related finding on a Socrata endpoint, please confirm you are testing against a private or privileged resource and not the public SoQL API. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. Duplicate and same root cause policy : Findings that share the same root cause and remediation path will be consolidated into a single finding for reward purposes, regardless of the number of affected endpoints. If multiple submissions from the same researcher share a root cause, we will notify the researcher and process one reward.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Socrata not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Socrata, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation. Note that leaked API keys and credential submissions are welcomed, however, we do not permit these to be tested by researchers prior to submission. Additionally, please do not submit credentials that appear to be related to unit testing or other early software development lifecycle stages as these typically do not carry any risk and will not be rewarded. Note that Socrata will have the final say on impact once they review any submitted API keys or credentials. Engagement Guidelines We strictly prohibit usage of Automated scanners - we have our own DAST :) Scripted verification of a specific, already-identified finding across a limited set of endpoints is permitted within the testing window. Mass enumeration or automated discovery of new findings is not. All testing should be limited to 0700-1800 PDT (GMT -7) - this helps our on-call staff stay sane :) Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing Perform research only within the scope set out below Use the identified communication channels to report vulnerability information to us Keep information about any vulnerabilities you’ve discovered confidential between yourself and Socrata If you follow these guidelines when reporting an issue to us we commit to: Not institute a civil legal action against you and not support a criminal investigation Work with you to understand and resolve the issue quickly (confirming the report within one week of submission) Recognize your contribution on our Security Researcher Hall of Fame, if you are the first to report the issue and we make a code or configuration change based on the issue Thank you for participating and happy hunting! Getting Started - General Usage Create a primary account at: https://opendata.test-socrata.com/ Please use the following format: [email protected] Example: [email protected] This will forward email to your registered Bugcrowd email address Display name = Bugcrowd (unique name) Example = Bugcrowd Jane Create a secondary account [to test account and data integrity] Please use the following format: email: [email protected] Example: [email protected] Display name = Bugcrowd (unique name) Example = Bugcrowd Jane02 If you are able to compromise any datasets or accounts to the point where you would be able to modify the data DO NOT DO SO . Let us know and we'll create a test dataset for you to try the changes on. Focus Areas Access Control Vulnerabilities Public or anonymous user access to non-public resources (i.e. Private drafts) Roled user access to restricted-role resources (i.e. accessing Private drafts not shared with that user) API endpoints returning private user data (e.g., email addresses, private file metadata, account details) to unauthenticated or low-privilege callers due to a missing authorization check. Publicly visible profile fields such as display names are not in scope under this item. Confidentiality Impact (private data access or leakage) Server-side Remote Code Execution (RCE) SQL Injection (SQLi) - Note: Please see notes on SQL vs. SoQL below before reporting SQLi Path/Directory Traversal Issues Stored XSS that executes in another user's browser session. Self-XSS (where the attacker and victim must be the same account) is excluded, regardless of whether the payload is triggered through normal application functionality or requires atypical steps (e.g., browser console injection). CORS misconfiguration (e.g., Access-Control-Allow-Origin: *) on endpoints serving only public, unauthenticated, read-only data, where no authentication or authorization is bypassed as a result. Authentication control bypass where a supported auth mechanism (e.g., Basic Auth, API keys) circumvents a security control that should apply platform-wide, such as MFA requirements or cross-origin request restrictions. Out of Scope Any customer sites hosted on the Socrata platform are explicitly off-limits. Any services hosted by 3rd party providers and services are excluded from scope. These services include: Third-party add-ons s3.amazon.com The following finding types are specifically excluded from the bounty and are things we do not want to see: Personally identifiable information of users (PII) that you may have found during your research Output from a commercial or commonly available scanning tool. We know. Seriously, don't try to brute-force other user accounts. Bug reports coming through any channels other than Bugcrowd. Do not file support tickets at support.socrata.com or e-mail our support staff. Please use the Bugcrowd portal. Findings from applications or systems not listed in the ‘Targets’ section Functional, UI and UX bugs and spelling mistakes Network and Application level Denial of Service (DoS/DDoS) vulnerabilities Clickjacking and issues only exploitable through clickjacking. CSRF attacks that require knowledge of the CSRF token (e.g. attacks involving a local machine). Content Spoofing. Login or Forgot Password page brute force and account lockout not enforced. Username or email enumeration via login, registration, or password reset flows. Note: API endpoints that expose user emails due to a missing access control are in scope under Access Control Vulnerabilities above. Reflected payloads appearing exclusively in application/json API responses where the Content-Type is not HTML and the response cannot be rendered as a web page. If the same endpoint returns HTML under any conditions, this exclusion does not apply. Missing HTTP security headers, e.g. Cache-Control and Pragma No Load testing (DoS/DDoS etc) is allowed. This includes application DoS as well as network DoS. Vulnerabilities that are limited to unsupported browsers will not be accepted. Missing or incorrect DMARC records of any kind. Source code disclosure vulnerabilities. Information disclosure of non-confidential information (e. g. issue id, project id, commit hashes). Email bombing/Flooding/rate limiting Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

In Scope (in scope)

Documentation Getting Started - UI Usage Getting Started - API Testing