My Kredivo Bug Bounty Program

PT FinAccel Teknologi Indonesia

Rp0 ~ Rp3.000.000Total reward

Description

FinAccel

FinAccel operates the credit lending app, Kredivo, in Indonesia, which has more than a million
customers to date. The Kredivo app enables customers to secure credit and its payment option is also integrated with e-commerce firms such as Tokopedia, Bukalapak, and Lazada, as well as offline merchants. This is so users can quickly access the credit to purchase things and pay via the app later.

FinAccel looks forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe.

Target info

Response Targets

FinAccel will make the best effort to meet the following response targets for hackers participating in our program:
●Time to first response (from report submit) - 2 business days
●Time to triage (from report submit) - 2 business days
●Time to bounty (from triage) - 5 business days
●Time to Resolution - depends on severity and complexity

We’ll try to keep you informed about our progress throughout the process.

Terms and Conditions

●As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
●There are constraints on who may participate in the FinAccel Bug Bounty Program (the ’Program’). In addition, there may be additional restrictions depending upon applicable local laws
●Any information you receive or collect about FinAccel through the Bug Bounty Program must be kept confidential and only used in connection with the Bug Bounty Program. You may not use, disclose or distribute any such Confidential Information, including, but not limited to, any information regarding your Submission and information you obtain when researching the FinAccel sites, without FinAccel prior written consent.
●Disclose the vulnerability report directly and exclusively to us. Please read and follow RedStorm’s [disclosure guidelines]

Program Rules

●Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
●Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.
●When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
●Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
●Social engineering (e.g. phishing, vishing, smishing) is prohibited.
●Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.

Key focus areas and vulnerabilities to look out for

●Remote Command Execution (RCE) on a Production server
●Bulk personally identifiable information (PII) exposure*
○Identification Number, Address, Taxpayer Identification Number (NPWP) are considered more critical PII, as compared to email address and phone number
●Misconfiguration leading to data breach
●Access to source code
●Restricted or limited account takeover
●Vertical/horizontal privilege escalations
●Authorization checks bypass allowing fraudulent transactions.

Information that are considered sensitive

Information about what is sensitive:
-Full Name
-NIK (KTP ID)
-Mobile Number
-Personal Email Address
-Name and Residential Address
-KK Number (Family Card Registry)
-Place and date of birth
-Password
-Bank Account Name and Number
-NPWP and Salary Information

Non-sensitive Information:
-External User ID
-User ID
-Phone Number without other information (eg: Full Name and Email)
-Transaction ID without other information (eg: Contains Full Name, Email, Address, and Email)

In-Scope Assets

●Website: https://my.kredivo.com/

Out-of-scope Assets

●Blogging site:
○blog.kredivo.com
○Finaccel.co
○kredivocorp.com
●Old web apps:
○app.kredivo.com
○mysandbox.kredivo.com
○https://doc2.kredivo.com/
●3rd party services used by PT. FinAccel Teknologi Indonesia

Rewards

Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of PT. FinAccel Teknologi Indonesia.

Critical (9.0 - 10.0) P1: Rp. 3.000.000 + Point
High (7.0 - 8.9) P2: Rp. 1.500.000 + Point
Medium (4.0 - 6.9) P3: Rp. 500.000 + Point
Low (0.1 - 3.9) P4: Rp.0 + Point

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

●Clickjacking on pages with no sensitive actions
●Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
●Attacks requiring MITM or physical access to a user’s device.
●Previously known vulnerable libraries without a working Proof of Concept.
●Comma Separated Values (CSV) injection without demonstrating a vulnerability.
●Missing best practices in SSL/TLS configuration.
●Any activity that could lead to the disruption of our service (DoS).
●Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
●Rate limiting or bruteforce issues on non-authentication endpoints
●Missing best practices in Content Security Policy.
●Missing HttpOnly or Secure flags on cookies
●Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
●Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
●Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
●Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
●Tabnabbing
●Open redirect - unless an additional security impact can be demonstrated
●Issues that require unlikely user interaction
●Exposure of third-party API keys with no significant security impact (eg. Google Maps API keys)
●Publicly accessible login panels without proof of exploitation.
●Publicly editable Git Wiki.
●Reports that state that software is out of date/vulnerable without a proof of concept.
●Disclosure of known public files or directories, (e.g. robots.txt).
●Issues that require physical access to a victim’s device.
●Weak Captcha / Captcha Bypass
●Login or Forgot Password page brute force and account lockout not enforced.
●HTML Injection
●Vulnerabilities involving active content such as web browser add-ons
●Promo code abuse (e.g. ordering multiple times using the same promo code)

###Out of Scope bugs for Android apps
●Any URIs leaked because a malicious app has permission to view URIs opened
●Absence of certificate pinning
●Sensitive data in URLs/request bodies when protected by TLS
●User data stored unencrypted on external storage
●Lack of obfuscation
●Lack of rooted detection
●Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceiver (exploiting these for sensitive data leakage is commonly in scope)
●Any kind of sensitive data stored in app private directory
●Lack of binary protection control in android app
●Runtime hacking exploits that are only exploitable on your own device using tools like such as Frida/ Appmon (exploits only possible in a rooted environment)

###Out of Scope bugs for iOS apps
●Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries
●Absence of certificate pinning
●Path disclosure in the binary
●User data stored unencrypted on the file system
●Lack of obfuscation
●Lack of jailbreak detection
●Crashes due to malformed URL Schemes
●Lack of binary protection (anti-debugging) controls
●Snapshot/Pasteboard leakage
●Runtime hacking exploits that are only exploitable on your own device using tools like such as Frida/ Appmon (exploits only possible in a jailbroken environment)

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep FinAccel and our users safe!

Reward

This program adheres to the RedStorm Vulnerability Rating Taxonomy for the prioritization/rating of findings. if relevant, the deviations from the VRT shoul be listed here in a markdown table:

P1 POINT REWARD 100 Rp3.000.000
P2 POINT REWARD 50 Rp1.500.000
P3 POINT REWARD 20 Rp500.000
P4 POINT REWARD 10 Rp0
P5 POINT REWARD 5 Rp0

Targets

In Scope
https://my.kredivo.com/
Website
Out of scope
Data do not exist yet

2

Vulnerabilities rewarded
Latest hall of fame
Friends
Private account
Copyright © 2018 - RedStorm. All rights reserved.TermsPrivacyContact