Under Armour Product Security

Description

Our Mission TO MAKE ALL ATHLETES BETTER THROUGH PASSION, DESIGN AND THE RELENTLESS PURSUIT OF INNOVATION. Our Brand is about energy and passion. It’s about an obsession with Fighting On Together to be stronger and more powerful - to Always Connect . We believe in Thinking Beyond to invent, innovate, and Create Fearlessly . We believe in staying connected To Athletes and know that adversity even in the digital world can bring us together. We know that the world expects great things from Under Armour and that daring to lead means thinking beyond. Our Brand Voice has always been simple and bold, as illustrated in our earliest commercial spot from 2003, rallying an entire generation of athletes to PROTECT THIS HOUSE . Under Armour Mission & Values We want to engage the security research community as partners & teammates to Stay True , protect our athletes, and protect their data. Doing so enables our Global Community of athletes to Celebrate their Goals . There are no odds too big. No goal too high. Will you PROTECT THIS HOUSE ? #WEWILL #WillFindsAWay Under Armour VRT Amendments Bug Type │ Original Priority Rating │ Under Armour Priority Rating Injection File – Inclusion – Local │ P1 │ P3 Injection – XML External Entity Injection (XXE) │ P1 │ P2 Cross-Site Scripting (XSS) – Stored │ P2 │ P3 Security Misconfiguration Misconfigured – DNS - With POC (High Impact Subdomain Takeover) │ P2 │ P3 Security Misconfiguration Misconfigured – DNS - With POC (Basic Subdomain Takeover) │ P3 │ P4 Sensitive Misconfiguration – Weak Password Policy – Complexity, Both Length and Char Type Not Enforced │ P3 │ P5 Security Misconfiguration – Lack of Password Confirmation - Change Email Address │ P4 │ P5 Security Misconfiguration – Lack of Password Confirmation - Change Password │ P4 │ P5 Security Misconfiguration – Lack of Password Confirmation - Delete Account │ P4 │ P5 Security Misconfiguration – Unsafe File Upload – No Antivirus │ P4 │ P5 Security Misconfiguration – Unsafe File Upload – No Size Limit │ P4 │ P5 Security Misconfiguration – Weak Password Policy – Complexity, Length Not Enforced │ P4 │ P5 Security Misconfiguration – Weak Password Policy – Complexity, Char Type Not Enforced │ P4 │ P5 Security Misconfiguration – Weak Reset Password Policy – Token is Not Invalidated After Use │ P4 │ P5 Security Misconfiguration – Captcha Bypass – Implementation Vulnerability │ P4 │ P5 Sensitive Data Exposure – EXIF Geolocation Data Not Stripped From Uploaded Images – Automatic User Enumeration │ P3 │ P5 Sensitive Data Exposure – EXIF Geolocation Data Not Stripped From Uploaded Images – Manual User Enumeration │ P4 │ P5 Missing Function Level Access Control – Username Enumeration – Data Leak │ P4 │ P5 Sensitive Data Exposure – Private API Keys – No POC │ P1 │ P5 Application - Level Denial-of-Service (DoS) – Low Impact and/or Medium Difficulty – Password Length DoS (Server-Side) │ P4 │ P5 Broken Access Control (BAC) - Username/Email Enumeration - Non-Brute Force │ P4 │ P5 Sensitive Data Exposure - Visible Detailed Error/Debug Page - Detailed Server Configuration │ P4 │ P5

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Under Armour not listed in the targets section is out of scope. This includes any/all subdomains not listed above. All official Under Armour social media accounts (e.g., Meta, Instagram, Twitter, LinkedIn, TikTok, YouTube). Access & Credentials Researchers must sign up for test accounts using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . If additional accounts are necessary, self-signup using the pattern: [email protected] Focus Areas Our primary focus is our athletes and their data. As such, Integrity & accuracy of user data Availability of user data for each user and for those they have chosen to share with Confidentiality of user data, and reflecting their privacy choices for that data. For example If a user sets a workout as public, all other users may see it. If they set to share with friends, non-friends should not see it. And if they mark as private, even their friends should not see it. Out of Scope Missing or incorrect SPF records of any kind Missing or incorrect DMARC records of any kind Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacking other users's accounts or devices Collecting & retaining user data extracted from the platform Attacking advertisers or digital advertising exchanges we partner with Attacking Under Armour advertisements on any website Distributing malware, ransomware, viruses, or worms on any UnderArmour or affiliated website Targeting administrative portals Infrastructure attacks on our cloud-based servers and the supporting providers Brute force on login or forgot password page and account lockout Note: If you encounter user data leaks while testing, we want to know, and will absolutely reward those defects. But once reported, we expect researchers to securely delete any data obtained in the process of testing & reporting those defects. However, while credentials found on the dark web or credential harvesting platforms should be reported, they will be treated as P5s as Under Armour has systems in place to scan for these. Out of Scope Bugs for Android Apps Shared links leaked through the system clipboard. Any URIs leaked because a malicious app has permission to view URIs opened Absence of certificate pinning Sensitive data in URLs/request bodies when protected by TLS User data stored unencrypted on external storage Lack of obfuscation is out of scope OAuth "app secret" hard-coded/recoverable in apk Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceive (exploiting these for sensitive data leakage is commonly in scope) Any kind of sensitive data stored in app private directory Lack of binary protection control in android app Out of Scope Bugs for iOS Apps Lack of Exploit mitigations ie PIE, ARC, or Stack Canaries Absence of certificate pinning Path disclosure in the binary User data stored unencrypted on the file system Lack of obfuscation is out of scope Lack of jailbreak detection is out of scope OAuth "app secret" hard-coded/recoverable in apk Crashes due to malformed URL Schemes Lack of binary protection (anti-debugging) controls Snapshot/Pasteboard leakage Runtime hacking exploits (exploits only possible in a jailbroken environment) Blackout Periods Due to athlete & business needs, certain dates will be off-limits for active security testing. This list will be updated regularly, so please check before engaging in active testing: Nov 20 to Dec 3 Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. Notwithstanding the program safe harbor, you are expected, as always, to comply with all applicable laws. Ulta reserves all of legal rights in the event of noncompliance. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.

Paid Targets (in scope)

APIs api.shop.ua.com/graphql Developer API portal & documentation: developer.underarmour.com Note that the API domains are typically used within the context of applications that use them. Going directly to the domain will not provide any usable content.