DRACOON – Bug Bounty Program
DRACOON offers secure file sharing and collaboration services with two products, DRACOON Cloud and DRACOON Server. Both products support built-in end-to-end encryption and offer many features tailored for large organizations, such as a complex roles and permissions system, SSO integration, auditing and reporting features.
Reward
Program
Hacktivity
DRACOON
DRACOON offers secure file sharing and collaboration services with two products, DRACOON Cloud and DRACOON Server. Both products support built-in end-to-end encryption and offer many features tailored for large organizations, such as a complex roles and permissions system, SSO integration, auditing and reporting features.
With this bug bounty program, we want to reinforce our commitment to security and reward security researchers for helping us protect our customers' data.
Program Rules
DRACOON wants to increase the security of its products by inviting security researchers to analyze the implementation of security measures in its product and to identify existing vulnerabilities. In order to achieve this goal together, it is important to us that the following rules are adhered to.
- (D)DoS attacks on our infrastructure are strictly prohibited. This includes (but is not limited to) all applications, services, servers and network infrastructure.
- Do not carry out load-based attacks (e.g. automated scanners that create a large number of requests).
- Do not interfere with any box that is not listed within the program scope.
- Do not decommission any boxes.
- Do not change network configuration.
- Do not change passwords of accounts (unless it’s your own) or delete other accounts.
- Do not extract information and disclose it if you should gain access to it irregularly.
- Do not alter, modify or delete any information stored in our cloud if you should gain access to it irregularly.
- Do not publish (even partially) any vulnerabilities that are found.
Reward Eligibility
We are happy to thank everyone who submits valid reports to improve the security of our cloud service, however only those that meet the following eligibility requirements may receive a monetary reward:
- You must be the first reporter of a vulnerability.
- The vulnerability must be a qualifying vulnerability (see below).
- Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through http://yeswehack.com.
- The vulnerability report must contain the following elements:
- A clear textual description of the vulnerability, how it can be exploited, its security impact and remediation advice.
- A proof of the exploitation of the vulnerability (e.g. screenshots, proof of concept code).
- The preconditions and steps required to reproduce the issue including code snippets, commands, request information, payloads, etc.
- You must not be a former or current employee of our company or one of its contractors.
- As DRACOON Cloud and DRACOON Server share the majority of the source code, we consider the same attack on both systems in scope as duplicate.
DRACOON Infrastructure Overview
Description of services
Services in scope
Core - This service is the heart of the backend. It is responsible for file upload, download, sharing, user and role management.
OAuth - Responsible for user authentication. Implements OAuth2.
S3 Storage - Storage location of binary data. Accessible via internet and heavy use of pre-signed S3 URLs to allow direct transfer between client app and storage.
Media - Responsible for image downscaling (e.g. for thumbnails).
Reporting - Responsible for generating various reports triggered by the user (e.g. reports on user activity). Creates PDF and CSV files.
WebDAV - Proxy service that allows to connect to DRACOON via WebDAV protocol.
Services out of scope
Branding - Allows customers to customize appearance. Manages customer branding configurations (e.g. logo, email signatures).
Signing - Acts as a proxy to our signing partner FP-Sign. Responsible for sending signing requests and storing signed documents in DRACOON.
Description of clients
Clients in scope
Web App - The main web application to access DRACOON via a browser. This is the only full-feature client.
Clients out of scope
Desktop Apps - Sync client for Windows and Mac. Mounts DRACOON as a virtual disk on the end user’s device.
Mobile Apps - Native apps for Android and iOS, that provide a subset of the features.
MS Teams App - App for MS Teams.
Outlook Add-In - Add-In for MS Outlook. Allows to convert attachments to share links.
Swagger UI - Swagger UI is an interactive API documentation. Most services provide a public Swagger UI client. See useful links section.
Area | Scope Type | Scope URL | DRACOON Cloud | DRACOON Server |
---|---|---|---|---|
Backend | Core Service | /api | yes | yes |
Backend | OAuth Service | /oauth | yes | yes |
Backend | S3 Storage | https://0-2744452194.s3.nbg01.de.dracoon.io | yes | no |
Backend | Media Service | /mediaserver | yes | no |
Backend | Reporting Service | /reporting[/api] | yes | no |
Backend | WebDAV Proxy | /webdav | yes | yes |
Frontend | Web App | / | yes | yes |
Useful links
- Bug Bounty Environments:
- DRACOON Cloud: https://bounty-cloud.dracoon.app
- DRACOON Cloud S3 Storage https://0-2744452194.s3.nbg01.de.dracoon.io
- DRACOON Server: https://bounty-server.dracoon.app
- User manuals, knowledge base:
- DRACOON Cloud: https://cloud.support.dracoon.com
- DRACOON Server: https://server.support.dracoon.com
- Public API documentation (SwaggerUI / OpenAPI 3.0):
- DRACOON Cloud
- Core Service: https://bounty-cloud.dracoon.app/api
- Reporting Service: https://bounty-cloud.dracoon.app/reporting/api
- DRACOON Server
- Core Service: https://bounty-server.dracoon.app/api
- DRACOON Cloud
- Public SDKs and crypto implementation: https://github.com/dracoon
- Whitepaper on e2e encryption: https://cloud.support.dracoon.com/hc/en-us/articles/360000986345-Whitepaper-Client-side-Encryption
Reward
Asset value | CVSS | CVSS | CVSS | CVSS |
---|---|---|---|---|
$500 | $1,000 | $3,000 | $5,000 |
Scopes
Scope | Type | Asset value | Expand rewards grid |
---|---|---|---|
https://bounty-cloud.dracoon.app/api | api | ||
Low Medium High Critical | |||
https://bounty-cloud.dracoon.app/oauth | other | ||
Low Medium High Critical | |||
https://0-2744452194.s3.nbg01.de.dracoon.io | other | ||
Low Medium High Critical | |||
https://bounty-cloud.dracoon.app/mediaserver | other | ||
Low Medium High Critical | |||
https://bounty-cloud.dracoon.app/reporting/api | api | ||
Low Medium High Critical | |||
https://bounty-cloud.dracoon.app/webdav | other | ||
Low Medium High Critical | |||
https://bounty-cloud.dracoon.app/ | web-application | ||
Low Medium High Critical | |||
https://bounty-server.dracoon.app/api | api | ||
Low Medium High Critical | |||
https://bounty-server.dracoon.app/oauth | other | ||
Low Medium High Critical | |||
https://bounty-server.dracoon.app/reporting/api | api | ||
Low Medium High Critical | |||
https://bounty-server.dracoon.app/webdav | other | ||
Low Medium High Critical | |||
https://bounty-server.dracoon.app/ | web-application | ||
Low Medium High Critical |
Out of scopes
- Any other host, tenant or service than the ones explicitly stated.
- www.dracoon.com
- *.dracoon.com
- *.dracoon.net
- *.dracoon.team
- *.dracoon.app (with the exceptions of bounty-cloud.dracoon.app and bounty-server.dracoon.app)
- *.dracoon.io (with the exception of https://0-2744452194.s3.nbg01.de.dracoon.io)
- *.fp-sign.com
- *.usersnap.com
- *.gdata.com
- *.retarus.com
Vulnerability types
Qualifying vulnerabilities
- Remote code execution (RCE)
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Code injections
- Insecure Direct Object Reference (IDOR)
- Horizontal and vertical privilege escalation
- Authentication bypass, broken authentication, broken session management
- Cross Origin Resource Sharing (CORS) with real security impact
- Cleartext Transmission of Sensitive Information (passwords etc.)
- Cross-site Request Forgery (CSRF) with real security impact
- Unauthorized access to files stored in DRACOON
- Unauthorized modification of files stored in DRACOON
- Unauthorized deletion of files stored in DRACOON
- Local files access and manipulation (LFI, RFI, SSRF, XSPA)
- Broken cryptographic implementation with working exploit
- Business logic vulnerability with real security impact
Non-qualifying vulnerabilities
- Any hypothetical flaw or best practices without exploitable POC
- Reports that affect only outdated devices, browsers or platforms
- Recently publicly disclosed vulnerabilities
- Non sensitive information disclosure: stack traces, path disclosure, directory listings, software versions, etc.
- Outdated libraries without a demonstrated security impact
- Vulnerabilities in third-party apps/libraries (not created by DRACOON)
- Credential stuffing
- UX bugs
- SSL/TLS best practices incl. missing security-related HTTP headers which do not lead directly to a vulnerability
- Tabnabbing
- Missing cookie flags
- Content/Text injections
- Mixed content warnings
- Missing security-related HTTP headers which do not lead directly to a vulnerability
- Clickjacking/UI redressing
- Denial of Service (DoS) attacks
- Lack of rate-limiting, brute-forcing or captcha issues
- Open ports without an accompanying proof-of-concept demonstrating vulnerability
- Social engineering of staff or contractors
- Presence of autocomplete attribute on web forms
- Reports from automated web/mobile vulnerability scanners that have not been validated
- Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)
- Protocol mismatch
- Exposed login panels
- Issues requiring physical access to a user’s computer/device/email/etc.
- Brute force attacks that cannot be demonstrated or completed in a reasonable amount of time
- Password and account recovery policies, such as reset link expiration or password complexity
- EXIF Geolocation Data Not Stripped From Uploaded Images
- Self-XSS or XSS that cannot be used to impact other users
- Unexploitable vulnerabilities (ex: XSS or Open Redirect in HTTP Host Header)
- Storing malware/bypassing antivirus detection
- Blind SSRF without direct impact (e.g. DNS pingback)
- Race condition issues without relevant security impact
- Ability to spam users (email / SMS flooding)
- User enumeration / account oracles (email, alias, ID, phone number)
- RTLO and related issues
- Timing attacks and vulnerabilities without demonstrable security impact
- Homograph attacks
- Text/HTML Injection
- Unauthenticated / Logout / Login and other low-severity Cross-Site Request Forgery (CSRF)
- Bugs that rely on unlikely or statistically improbable user interaction
- Cross-Site Request Forgery not exploitable with Chrome > 80
- CSV injection
- Subdomain takeover without a full working PoC
- Providing encrypted garbage data/keys without exploitable impact
- Cryptographic attacks based on weak keys or weak passwords
- Exploits of the underlying infrastructure (Docker, Kubernetes, etc.); please report those directly to the respective vendors/communities.
- Attacks on suppliers of integrated services (UserSnap, FP Sign, GDATA, Retarus, Anexia).
Hunting requirements
Account access
You will receive full admin access to the respective systems. Please request an account by contacting security@dracoon.com and using the subject "Bug Bounty program: Account request" and providing your YesWeHack email alias in the body. You will shortly receive welcome emails from the systems in scope with your initial passwords.
User agent
Please append to your user-agent header the following value: ' -bug-bounty-yeswehack '.
Hunters collaboration
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.
For more information, see help center.
Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.