XL Axiata MFT Bug Bounty Program

XL

Rp0 ~ Rp10.000.000Total reward

Description

PT XL Axiata

XL Axiata is a leading telecom company in Indonesia, providing convergence services to enhance people’s daily lives and boost the digital economy.

We have been in operation since October 8, 1996, offering a wide range of services to retail and corporate customers through a robust nationwide network. In 2015, we introduced a national-scale 4G LTE network and expanded to 5G in Q3 2021.

Target info

SCOPE

The targets included in this program are web applications and mobile applications with the URL that can be access at the link below:

Web: mft.xlaxiata.my.id

All of the target bellow will be considered as out of scope eventhough the severity is critical:
e-atp
tvkamu
Laut Nusantara
Sisternet
flexiot
https://zeus.xl.co.id

Known issues:
Please note that the XL Axiata Security Team also actively looks for vulnerabilities across all assets internally. Vulnerabilities listed below marked as known issues:

  1. msisdn enumeration / harvesting

Test Number:
Please use Indonesian mobile number XL. We use OTP to validate your number during login.

WARNING:

  • Disclosing all kinds of vulnerabilities / submissions in this program to the public are prohibited, Researchers who do so will be banned and all awards will be annulled in this program

XL also want to know the vulnerability in other targets that are out of scope but can have a CRITICAL / HIGH impact on XL, either directly or indirectly (for example through 3rd party apps). For this reason, if researcher finds a new target outside the list listed above that has a CRITICAL / HIGH risk, please contact the RedStorm team via email to be considered for a reward

[email protected]

RULE OF THE GAME

Reporting must go through the ’Submit Report’ feature on the RedStorm web application by including evidence and how to exploit it.
The level of risk from the findings can be selected and considered by the researcher provided are:

  • P1 - Critical
  • P2 - High
  • P3 - Moderate
  • P4 - Low
  • P5 - Information / Other

The points to be awarded by the system are:

  • P1 - 100
  • P2 - 50
  • P3 - 20
  • P4 - 10
  • P5 - 5

Prizes / rewards that will be given depend on considerations of security risks following the following scheme:

  • P1 - IDR 10.000.000 (+ Points)
  • P2 - IDR 7.000.000 (+ Points)
  • P3 - Points
  • P4 - Points
  • P5 - Points

The P1 Reward is only specifically for researchers who managed to find security bug that able to retrieve data as below:

Data Types Minimum Criteria
Selfie Photos Image File contain valid selfie photos
Signature photos Image File contain valid signature photos
ID Card Photos Image File contain valid ID Card photos
PII data NIK, KK, Full Name, Address, Contact, Date of Birth
Financial Information Plaintext Credit Card, CVV, Payment token

GUIDELINES FOR CONDUCT

RedStorm wants to create a business environment that is safe and upholds ethical professionalism.
For this reason, there are three main aspects that every security researcher who participates in programs on our platform should pay attention to:

  • CONFIDENTIALITY - All reported security vulnerabilities should not leak into public spaces.
  • INTEGRITY - Only report security issues that are deemed valid and do not use the findings of the security vulnerabilities for tampering purposes. If there is more than 1 report regarding the same security problem, then the first one to report will be considered valid.
  • PROFESSIONALISM - Security researchers are fully responsible for the findings reported and should be contacted if necessary for explanation or other complementary information.

ACCEPTANCE CRITERIA

Submission process
If you believe you have found a security vulnerability, please file a report for the program concerned through RedStorm platform.
Any security vulnerability report submissions will be treated with high priority, including when the report is validated, when we need more information from you, or when you qualify for a reward. Each submission is evaluated by us on a first-in first-served basis.

Basic Rules
RedStorm is committed to protecting the interests of security researchers.
The more your behavior follows these rules, the more we can protect you in the event of an uneasy disclosure situation.

Each program can have varying rules.
Please carefully read the Program Summary for specific regulations, if any.
However, the following rules apply to all programs:

  • Research that is carried out should only be on systems listed under the ’Scope’ section of the Program Brief. Any other system is beyond its scope.
  • Unless otherwise stated in the Program Summary, you must create test accounts for research purposes.
  • Submissions must be made EXCLUSIVELY through RedStorm to be considered a prize.
  • Submission-related communications must remain within RedStorm or the official RedStorm support channels during the disclosure process.
  • Actions that affect the integrity of the target program or destabilize it are prohibited. If you notice a decrease in performance on the target system, you should immediately suspend all use of automated tools.
  • The submission must have impact on the target’s security posture. Impact means a reported issue affecting the target user, system, or data security in a significant way. Researcher can be asked to keep the impact confidential in order to be eligible for the prize.
  • Submissions may be closed if the researcher is not responsive to requests for additional information after 7 business days.
  • The existence or details of programs are private or invitation may not be communicated to anyone who is not a RedStorm employee or an authorized employee of the organization responsible for the program.
  • We encourage researchers to include videos or screenshots (proof-of-concept) in reporting security vulnerabilities. These files may not be shared publicly. This includes uploading to any website that is publicly accessible (like Vimeo, Imgur, etc.). If the file exceeds 50 MB, upload the file to a secure online folder such as Dropbox that is protected with password.
  • The RedStorm Disclosure Policy applies to all submissions made through the RedStorm platform, including for Duplicate, Out of Scope, and Not Applicable findings reports. Program owners can choose a Disclosure, Coordinated Disclosure, or Specific Information Disclosure Policy to apply to their program summary. Please see our Additional Disclosure Policy for details on the different Public Disclosure Policies on RedStorm.
  • If a researcher wishes to retain disclosure rights for vulnerabilities that are outside the scope of a program’s scope, he or she must report the problem to the relevant vendor directly. RedStorm can assist researchers in identifying suitable email addresses to contact. Program owners are encouraged to ensure that their program coverage includes all the critical components for which they wish to receive vulnerability reports.
  • Violation of the disclosure policies stated by the program may result in enforcement action as outlined in the RedStorm Terms of Service.

Violation of these rules may result in the cancellation of delivery and confiscation of all prizes, both for current and future programs on the RedStorm platform.

Types of Accepted Submission
Below are the types of submission that are preferred to be accepted:

  • Broken authentication
  • Multi Factor Auth Bypass
  • OTP Bypass (Untrusted Devices)
  • Bypass Authorization Schema
  • SQL Injection
  • XSS Injection
  • Sensitive Data Exposure
  • Business Logic
  • Cross-Site Request Forgery (HIGH-CRIT ACTION)
  • Server Side Request Forgery
  • Remote Code Execution
  • Local File Disclosure
  • Server Side Injection Templates

Types of Submission Excluded
Some types of submissions are excluded because they are dangerous to assess, or because they have a low security impact on program owners. This section contains issues that XL cannot accept, which will immediately be marked invalid and not rewarded.

  • Findings from physical testing such as office access (eg open doors, tailgating).
  • Findings originating from social engineering or social engineering (eg phishing, vishing).
  • Findings from applications or systems that are not listed in the ’Scope’ section.
  • Functional, UI and UX bugs and misspellings (typos).
  • Denial-of-service (DoS or DDoS) vulnerabilities at the network level.
  • General submission types that do not include qualifications

Several types of submissions we rate do not qualify for prizes because they have a low security impact for program owners.
Below is a list of issues that are commonly reported and reproducible but do not meet the requirements.
We strongly advise you not to report this problem unless you can demonstrate a possible attack with valid security implications for program owners.

  • Descriptive error messages (eg stack traces, application or server errors).
  • HTTP 404 code / page or other non-200 HTTP code / page.
  • Banner disclosure on public services.
  • Disclosure of known public files or directories (eg Robots.txt).
  • Click-jacking and problems that are only exploited through it.
  • CSRF on a form available to anonymous users (eg contact form).
  • Login / Logout CSRF.
  • Presence of an application or an ’auto-complete’ or ’save password’ function in a web browser.
  • Lack of Secure and HttpOnly flags on cookies.
  • Lack of security speed bumps when leaving the website.
  • Weak captcha or bypass captcha.
  • Enumeration of username/msisdn via login page error message.
  • Enumerate username/msisdn via the message ’Forgot Password’.
  • Brute force on the login page or on the forgot your password page and result in account lockout.
  • HTTP TRACE option enabled.
  • SSL attacks such as BEAST, BREACH, or around a renegotiation vulnerability.
  • SSL forward secrecy.
  • SSL which supports cipher suite algorithms is not secure.
  • MIME-Sniffing or X-Content-Type-Options header.
  • HTTP security header not found.
  • Invalid or missing SPF (Sender Policy Framework) records or related to other e-mails (SPF / DKIM / DMARC).
  • Automated scanning results using tools such as vulnerability scanners (Nessus, nikto, Qualys, OpenVAS, Core Impact, Acunetix, Nexpose, SecureCheq, Retina, MBSA, HIAB, and so on) even though the results include a potential security risk.
  • Absence of Rate Limitation
  • API Key / Secret disclosure
  • All of the API key/secret key below will be considered as out of scope:
  1. firebase database url
  2. google maps api key
  3. google crash reported api key
  4. hansel app key

Out of Scope bugs for mobile application:

  • Any URIs leaked because a malicious app has permission to view URIs opened.
  • Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries.
  • Absence of certificate pinning.
  • Path disclosure in the binary.
  • Lack of binary protection control in android app.
  • User data stored unencrypted on the file system/external storage.
  • Sensitive data in URLs/request bodies when protected by TLS.
  • Lack of obfuscation.
  • Lack of rooted/jailbreak detection.
  • Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceiver (exploiting these for sensitive data leakage is commonly in scope).
  • Any kind of sensitive data stored in app private directory.
  • Runtime hacking exploits that are only exploitable on your own device using tools like such as Frida/ Appmon (exploits only possible in a rooted environment).

PROGRAM REWARDS

You will be eligible for a prize if you are the first to report a previously unknown AND vulnerability to code or configuration that could impact to code changes, configuration changes or data changes. Rewards will be sent periodically every month.

Reward

This program adheres to the RedStorm Vulnerability Rating Taxonomy for the prioritization/rating of findings. if relevant, the deviations from the VRT shoul be listed here in a markdown table:

P1 POINT REWARD 100 Rp10.000.000
P2 POINT REWARD 50 Rp7.000.000
P3 POINT REWARD 20 Rp0
P4 POINT REWARD 10 Rp0
P5 POINT REWARD 5 Rp0

Targets

In Scope
mft.xlaxiata.my.id
Website
Out of scope
Data do not exist yet

0

Vulnerabilities rewarded
Latest hall of fame
Copyright © 2018 - RedStorm. All rights reserved.TermsPrivacyContact