Dear Hunters,
Thank you for your passion and dedication to our bug bounty program. We would like to let you know that our internal evaluation team will not be fully staffed during the holiday season. We will continue to collect your reports, but we will suspend evaluation until CW02 (January 6th). After that, we will resume processing reports, and it may take a few days to respond to your findings.
Please be assured that we will evaluate all reports and continue to maintain the program in 2025.

Have a great holiday season and see you in 2025!
Your DRACOON Security Team

---

DRACOON

DRACOON offers secure file sharing and collaboration services with two products, DRACOON Cloud and DRACOON Server. Both products support built-in end-to-end encryption and offer many features tailored for large organizations, such as a complex roles and permissions system, SSO integration, auditing and reporting features.

With this bug bounty program, we want to reinforce our commitment to security and reward security researchers for helping us protect our customers' data.

Program Rules

DRACOON wants to increase the security of its products by inviting security researchers to analyze the implementation of security measures in its product and to identify existing vulnerabilities. In order to achieve this goal together, it is important to us that the following rules are adhered to.

• (D)DoS attacks on our infrastructure are strictly prohibited. This includes (but is not limited to) all applications, services, servers and network infrastructure.
• Do not carry out load-based attacks (e.g. automated scanners that create a large number of requests).
• Do not interfere with any box that is not listed within the program scope.
• Do not decommission any boxes.
• Do not change network configuration.
• Do not change passwords of accounts (unless it’s your own) or delete other accounts.
• Do not extract information and disclose it if you should gain access to it irregularly.
• Do not alter, modify or delete any information stored in our cloud if you should gain access to it irregularly.
• Do not publish (even partially) any vulnerabilities that are found.

Reward Eligibility

We are happy to thank everyone who submits valid reports to improve the security of our cloud service, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through http://yeswehack.com.
• The vulnerability report must contain the following elements:
  1. A clear textual description of the vulnerability, how it can be exploited, its security impact and remediation advice.
  2. A proof of the exploitation of the vulnerability (e.g. screenshots, proof of concept code).
  3. The preconditions and steps required to reproduce the issue including code snippets, commands, request information, payloads, etc.
• You must not be a former or current employee of our company or one of its contractors.
• As DRACOON Cloud and DRACOON Server share the majority of the source code, we consider the same attack on both systems in scope as duplicate.

DRACOON Infrastructure Overview

Description of services

Services in scope

Core - This service is the heart of the backend. It is responsible for file upload, download, sharing, user and role management.
OAuth - Responsible for user authentication. Implements OAuth2.
S3 Storage - Storage location of binary data. Accessible via internet and heavy use of pre-signed S3 URLs to allow direct transfer between client app and storage.
Media - Responsible for image downscaling (e.g. for thumbnails).
Reporting - Responsible for generating various reports triggered by the user (e.g. reports on user activity). Creates PDF and CSV files.
WebDAV - Proxy service that allows to connect to DRACOON via WebDAV protocol.

Services out of scope

Branding - Allows customers to customize appearance. Manages customer branding configurations (e.g. logo, email signatures).
Signing - Acts as a proxy to our signing partner FP-Sign. Responsible for sending signing requests and storing signed documents in DRACOON.

Description of clients

Clients in scope

Web App - The main web application to access DRACOON via a browser. This is the only full-feature client.

Clients out of scope

Desktop Apps - Sync client for Windows and Mac. Mounts DRACOON as a virtual disk on the end user’s device.
Mobile Apps - Native apps for Android and iOS, that provide a subset of the features.
MS Teams App - App for MS Teams.
Outlook Add-In - Add-In for MS Outlook. Allows to convert attachments to share links.
Swagger UI - Swagger UI is an interactive API documentation. Most services provide a public Swagger UI client. See useful links section.

Area	Scope Type	Scope URL	DRACOON Cloud	DRACOON Server
Backend	Core Service	/api	yes	yes
Backend	OAuth Service	/oauth	yes	yes
Backend	S3 Storage	https://0-2744452194.s3.nbg01.de.dracoon.io	yes	no
Backend	Media Service	/mediaserver	yes	no
Backend	Reporting Service	/reporting[/api]	yes	no
Backend	WebDAV Proxy	/webdav	yes	yes
Frontend	Web App	/	yes	yes

Useful links

• Bug Bounty Environments:
  • DRACOON Cloud: https://bounty-cloud.dracoon.app
  • DRACOON Cloud S3 Storage https://0-2744452194.s3.nbg01.de.dracoon.io
  • DRACOON Server: https://bounty-server.dracoon.app
• User manuals, knowledge base:
  • DRACOON Cloud: https://cloud.support.dracoon.com
  • DRACOON Server: https://server.support.dracoon.com
• Public API documentation (SwaggerUI / OpenAPI 3.0):
  • DRACOON Cloud
    • Core Service: https://bounty-cloud.dracoon.app/api
    • Reporting Service: https://bounty-cloud.dracoon.app/reporting/api
  • DRACOON Server
    • Core Service: https://bounty-server.dracoon.app/api
• Public SDKs and crypto implementation: https://github.com/dracoon
• Whitepaper on e2e encryption: https://cloud.support.dracoon.com/hc/en-us/articles/360000986345-Whitepaper-Client-side-Encryption