Easyship Public Bug Bounty Program

Easyship

Easyship is an end-to-end logistics platform, built to enable hyper-local to cross-border eCommerce, while removing barriers to entry, like inefficient systems and prohibitive costs for SMEs. As a user-centric product, Easyship has helped to simplify the complex world of logistics for more than 40,000 clients worldwide, making it more accessible for eCommerce SMBs and startups to grow.

The goal of these programs is to assist us in improving our users' security which is one of our top priorities.

Please note that reward will depend on real business impacts, not only the CVSS scoring. For example, a SSRF will not be scored Critical unless you're able to demonstrate a critical business impact (please do coordinate with us).

Here are a few examples of business impacts:

• Massive dumping / leak of PII of customer data
• Ability to bypass cart, voucher, checkout, promotion rules to gain price advantage.
• Ability to bypass business logic in order management, cancellation and returns that leads to financial losses to EasyShip (without the use of social engineering)
• Complete an "Unpaid Order" successfully without making any payment
• RCE on production infrastructure (not in a sandbox/staging)
• At scale fraud

Bypassing access to premium features has low business impact for us and will be treated as a non-qualifying vulnerability.

Reminder

• Please ONLY use your YesWeHack email aliases to create accounts (aliases for your account are in "MY YES WE HACK" menu). Other email addresses will not be accepted.
  Should you require more alias contact: support@yeswehack.com

Program Rules

• We believe that no technology is perfect and that working with skilled security researchers is crucial in identifying weaknesses in our technology.
• If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.
• Any type of denial of service attacks is strictly forbidden, as well as any interference with network equipment and pulse infrastructure.
• You must not attempt to gain access to, or interact with, any users other than those created by you
• You must not have compromised the privacy of our users
• You must not schedule meetings as part of testing activities. Scheduling meetings can block time that is otherwise reserved for genuine customers, causing disruptions to business operations.
• We will use the "OneFixOneReward" process: if two or more endpoints/forms use the same code base and a single fix can be deployed to fix all the other weaknesses, only one endpoint will be considered eligible for a reward and other reports will be closed as Informative. In any case, all reports will be reviewed edge by edge.

Eligibility and Responsible Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security of EasyShip however, only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below)
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through yeswehack.com
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about 10 requests per second).
• You must not leak, manipulate, or destroy any user data.
• You must not be a former or current employee of EasyShip or one of its contractor.
• Vulnerability disclosure, even partial is NOT allowed.

Reports about vulnerabilities are examined by our security analysts. Our analysis is always based on worst case exploitation of the vulnerability, as is the reward we pay.

Known issues

• Email verification bypass on signup
• Vertical Privilege Escalation on the team management (IDOR within the same company)
• Broken Link Hijacking