Volkswagen

Description

Volkswagen invites you to test and help secure our primary publicly facing assets - focusing on our primary German website. We appreciate your efforts and hard work in making the internet (and Volkswagen) more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please be aware that we have some quality assurance and test systems within our scope, as well as some showrooms / click-dummies. Most of the systems - but not all - have something like "qa" "q", "test", "staging", "dev", "pre" in their name. As those stages(i.e. test->qa->prod) share the same codebase and are used for staged deployment of new releases, we will only reward the highest valued system from the first report we get regarding a destinct bug. Please beware that we might lower the bounty for non prod systems according to their impact when only dummy data is affected and no further relevance (e.g. RCE, cookie stealing from other domains, ...) can be seen. We apologize for not being able to clearly mark those systems and promise rewards with respect to your work. Please make sure if you found a bug to try to reproduce this on prod to get the most value out of your bounty. Also make sure to provide neccessary evidence (e.g. screenshots) in case a system goes down during triage.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Volkwagen not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Volkswagen, it may be reported here . However, do be aware that is ineligible for rewards or points-based compensation Credentials: No credentials will be provided for this program. However, if any application that is found allows for account creation that would be considered in scope. If any accounts are able to be created, please use your @bugcrowdninja.com email address. Scanning Activity Please do not use automated vulnerability scanners on this program. Custom scripts and fuzzing tools are permitted, but if using them, please keep your traffic to six requests per second or less. Additionally, it’s worth noting that the client already runs automated scans from Nessus et al., against the in-scope targets – so using these tools is likely of minimal utility to researchers. As such, please avoid using them unless for targeted, specific testing, and then only at less than six requests per second. The following finding types are out of scope: Self XSS Email spoofing (including SPF, DKIM, DMARC, From: spoofing, and visually similar, and related issues) CSRF issues that don't impact the integrity of an account (e.g. log in or out, contact forms and other publicly accessible forms) Lack of rate limiting Denial of Service attacks Issues only exploitable on user devices with old versions of operating systems or browsers Recent unpatched CVEs in third party products/libraries CVEs without security impact in third party products/libraries The following finding types are currently not eligible for rewards (P5), except if a concrete impact is demonstrated: Internal IP address disclosure Vulnerabilities of third party libraries without showing specific impact (e.g. CVE with no exploit) Information leaks without direct security impact (e.g. detailed server configuration, metrics/health endpoints, debug pages, descriptive error messages, stack traces, application or server errors, path disclosure) Clickjacking and issues only exploitable through clickjacking Missing security best practices (e.g. missing CORS or Cache-Control header or Secure and HTTPOnly cookie flags without impact) HTTPS mixed content scripts 3rd party content that is hosted on our site, but is controlled by the third party and only impacts the third party, for example broken social media links of car dealerships in the dealer search Use of expired / self-signed Cryptographic Key (or Certificate) Cases for dangling IPs will be classified as follows: If the researcher was able to claim the IP, or the IP is still available at time of report, the case will be treated like a subdomain takeover If the IP was already reassigned to a third party, and it can be demonstrated that the third party is malicious, the case will be treated as a P4 with the "Indicator of Compromise" VRT If the IP was already reassigned to a third party that is not malicious, the case will be treated as P5

• These lists may not be exhaustive Data Protection As a responsible company we attach great importance to the careful, trustworthy and legally compliant handling of personal data of our customers, employees and business partners. The protection of this data is not only a legal obligation for us but an essential part of our corporate values and the basis for a trusting cooperation. For this reason it is important for us to make an explicit reference to data protection at this point. No personal data is to be processed in the context of the above described research activities. Only anonymized or non-personal data is to be used. However, if an identified vulnerability allows unintentional access to data (personal data or other sensitive information, such as personally identifiable information (PII), health data (PHI), credit card data or confidential company information) and access to personal data cannot be completely avoided in the course of researcher's activities access must be discontinued immediately and the vulnerability must be reported immediately. In connection with the research activity all applicable data protection laws and other legal requirements for the access to and processing of personal or other sensitive data must be complied with. All personal data and other sensitive information obtained in the course of the research activity may not be stored, used for other purposes or passed on to third parties and must be deleted immediately, independently and in compliance with data protection regulations after the investigation has been completed or after the vulnerability has been reported. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

In Scope Targets (in scope)

Target Information Any target on the Volkswagen Germany domain is considered as in scope for this program.

Out of scope targets (out of scope)

erwin.volkswagen.de is currently out of scope, except for findings where you can demonstrate an impact on other systems (e.g. RCE, SSRF, Cookie stealing on volkswagen.de).