VR Public Managed Bug Bounty Engagement

Description

We are a modern passenger, logistics and maintenance service company owned by the Finnish state which operates in Finland and Sweden. Please follow the rules detailed in this page to prevent unforeseen security problems to the clients of VR, their data or the business of the VR Group. Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Engagement Guidelines To gain the biggest bounty you need to be for example able to gain access to most or all client data or their personal details, or are able to misuse their payment methods. This will require a well-documented proof of concept code If the vulnerability reported does not create a risk or is not a security issue, we reserve the right to not award a bounty If the vulnerability is in a publicly available and widely used library, we may award a bounty which is smaller than usual If you report to us several vulnerabilities which turn to be different versions of the same root cause vulnerability, or the vulnerability is a smaller aspect of a bigger vulnerability, these reports can be combined for determining the bounty. Due to regulations, we interact with the original reporter only when discussing the reported vulnerabilities

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of VR Group not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to VR Group, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation. Focus Areas We are interested in all kinds of privacy issues, protection of client data and information from unauthorized disclosure to data loss, problems with the protection of client ticketing information. Payment system security, payment method handling and/or loss or abuse of payment methods. Methods of blocking, slowing down or causing other availability issues to the systems. Reports on issues, which cause small monetary losses or a small number of discounted tickets to be issued, or other problems with small business impact may not be eligible for bounties. Access When conducting any automated testing or scans, use a reasonable rate for sending requests. Do not send unnecessarily many requests in a quick succession. When conducting automated testing, include the following header in requests: X-VR-BB: bugcrowd- When sending occasional, single requests, the header is not needed, but we recommend always including it during testing. Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Excluded Submission Types P5 vulnerabilities Availability/volumetric testing e.g.: DDoS/Network DoS (application level or misconfiguration DoS is allowed if the PoC doesn't disrupt business) Code injections to the backend systems (for example SQL-injection) where the data in the backend is changed or deleted, or read in unnecessary quantities. Code injections themselves are allowed, the limitation is the to the functionality and scope of the research and Proof of Concept code. For example, you can read some data to demonstrate the vulnerability but do not dump all the data, nor delete or change any data. Report by an automated scanner, which in general are very speculative and tentative. Configuration issues with email servers (SPF, DMARC, ...) SSL/TLS configuration best practices or the lack of them (unless there is a clear and demonstrable vulnerability). Issues related to SSL/TLS configuration which are found by SSLabs scanner or similar. Best practices or the lack of them related to HTTP security headers. Forms with a theoretical CSRF vulnerability. CSRF vulnerabilities with a clear impact and a working PoC may be accepted. Logout CSRF Reports related to password strength or quality. Web contents spoofing or text injection Information disclosure of version numbers or similar, which are not related to a definite exploitable vulnerability. Reports related to cookies and their configuration. Issues in error page configuration. Self-XSS and XSS with no possible security impact N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 01/15/2025 Out of Scope Interacting or manipulate other stakeholders and their associated accounts including: Social engineering attacks Phishing attacks Physical attacks Third party providers and services Actions and methods that cause, or will probably cause, disruption to the business. Any actions that threaten the security of an individual persons. Leaked Credentials If you happen to identify leaked credentials that are VR Group related ([email protected]) or other VR Group related users, we appreciate you reporting it to this program, but in most cases no bounty is awarded for this to not encourage obtaining leaked credentials through illegal means. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance. VR Group employees If you are a VR Group employee or otherwise working with VR Group, you are allowed to participate in the Bug Bounty Program, but you must include your name and indicate this in the bug report. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.

In Scope (in scope)

Description Vr.fi is a site where customers can buy tickets for trains and get information about train schedules, alerts and locations. It is possible for our customers to create accounts and for us it is important that customer data is kept safe and that the integrity of our ticketing system is not compromised.