Viator

Description

We appreciate all security concerns brought forth and are constantly striving to keep on top of the latest threats. Being pro-active rather than re-active to emerging security issues is a fundamental belief at Viator. Every day new security issues and attack vectors are created. Viator strives to keep abreast on the latest state-of-the-art security developments by working with security researchers and companies. We appreciate the community's efforts in creating a more secure world. Good luck, and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.

Targets

Only the ‘In Scope’ targets listed above are in scope for this engagement. Any subdomain/domain/property not listed is out of scope. Program Guidelines We would like to get as broad coverage as possible but we also have to be sensitive to our suppliers, as well as our users, so we would like all testing to be done with an awareness that some actions will directly affect many people outside of our company. For example, a review of a tour which contains incorrect statements about the tour could negatively affect future bookings for that tour and the supplier. Another example is making test bookings on production for real products and suppliers. The supplier may not necessarily be aware they are test bookings. This can result in unused inventory for the supplier. Accordingly, we request that testers abide by the guidelines below. Our primary interest is finding security holes. We are not at this time interested in attacks on content quality, vulnerability to spamming, manipulation of tour ratings, or manipulation of user generated content (user submitted tour reviews and photos). Whenever making any test bookings, signing up as a partner, or initiating any Live Chats always use 'BUGCROWD' in the name or language We would request that you keep test bookings to a minimum. But they are possible and necessary to test the payment and post-purchase workflows on our systems. To make a test booking please follow the following rules... Make sure the surname for all travelers is TEST Make sure you add "This is a test booking - please ignore" in the Special Requirements field Please only book the following product codes: 73111P1, 73111AUTOTEST1, 73111AUTOTEST5, 73111AUTOTEST8, 73111AUTOTEST10 -- Note: to use a test product you'll need to search for it directly in the search box on the homepage -- Test products do not return in product searches and are not on any of the listings pages -- URL will look like this: https://www.viator.com/tours/Barcelona/Automated-Test-Product-Only/d562-73111AUTOTEST10 Make sure it is booked for a date at least 3 months in advance Use your own credit card to complete the booking Once your testing is complete please go into the booking self service screen and cancel your booking for a full refund to your credit card. Please make sure to do this at least 2 months before the original booking date To make a test Suppliers through Viator's supplier sign up page, start the supplier name with 'BUGCROWD' Please make sure to accurately follow the above steps to avoid a charge to your credit card Access To gain access, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Excluded Submission Types Fingerprinting / banner disclosure on common/public services HTTPS Mixed Content Scripts Incomplete or missing or misconfigured SPF/DKIM/DMARC issues Exploits around mass content submission, account creation or spamming Disruption of service either through DOS attacks, exploitation of performance problems, or trying to fill up a database Social engineering attacks Attacks requiring physical access to Viator locations or property Exploits against mobile applications requiring physical access to the device or that require warranty voiding actions (e.g., rooting the device) Exploits against the site from webviews within mobile applications NOT published by Viator All vulnerabilities related to throttling requests across partners.viator.com and their subdomains. This includes mass account creation, repeated signup/login attempts, repeated triggering of built in emails (like reset password / welcome etc.). Submissions of “no session expiry on logout” and any similar submissions on the iframe. All vulnerabilities related to Firebase-native behavior Any vulnerabilities in regards to a feature that requires KYC verification is out of scope on partners.viator.com , Viator does not have a process for researchers to be verified securely We are interested in reports of leaked API keys and secrets that grant access to in-scope assets; however, leaked usernames and passwords from third-party breaches are strictly out of scope. All vulnerabilities and issues related to email verification flows (including lack of verification, bypasses, or rate limiting) will be strictly classified as P5 (Informational). If at any time you have questions or concerns, please inquire via Bugcrowd Support before going any further.

Viator In Scope Targets (in scope)

Target Information https://viatorapi.viator.com/service/directory - Please use Api Key = 6375393012636041517 For security reasons, viator.com iframes its proxy as gtm-orn.viator.com on some pages. Viator is very focused on making sure the iframes are secure and gtm-orn.viator.com is in scope, however, Viator is not interested in reports of “no session expiry on logout” and similar submissions. Please note - The same issued raised on multiple language sites will be treated as duplicates. Note on Customer API Keys: Reports of leaked or exposed Customer API keys will be rated as P4 and are eligible for points only (no monetary reward).