France Identité Numérique - Public Bug Bounty Program

📢 About France Identité

A system to prove your identity and manage the sharing of personal data online and offline.

"France Identité" is a solution developed by the French government allowing its citizens to create and manage their digital identity. The system relies on the smartcard chip embedded in every new French identity cards.

The solution allows users to:

• identify/authenticate themselves on compatible web services
• generate a digital proof of identity relying on PAdES signatures (aiming to replace ID copies)
• validate a digital proof of identity
• manage the lifecycle of their digital identity (including their PIN)
• get a digital identity with a high level of assurance (in accordance with eIDAS regulation)

🎯 Objectives

As official French government digital identity solution, France identité must ensure constantly a high level of security for its mobile applications and its information system. In this way, we guarantee to the French citizens a trusted service. We are especially concerned about the following issues:

• User's data exfiltration
• Users' misused identity

📌Program Rules

Testing Policy and Responsible Disclosure

Please adhere to the following rules while performing research on this program:

• Denial of service (DoS) attacks on our applications, servers, networks or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic.
• Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
• Do not copy any files from our applications/servers and disclose them.
• No vulnerability disclosure, full, partial or otherwise, is allowed.

Reward Eligibility and Amount

We are happy to thank everyone who submits valid reports which help us improve our security, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and our organisation, and remediation advice on fixing the vulnerability
  • Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact
  • Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
• You must not break any of the testing policy rules listed above.
• You must not be a former or current employee of Ministry of interior (ANTS, DTNUM...), FranceConnect, ANSSI, IN group, SGIN contractors (Sopra Steria, ATOS, IDEMIA/IDAKTO) and all compagnies who carried out audits on SGIN system.
• If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded according to your findings.
• The triage team will use the "One Fix One Reward" process: if two or more endpoints/forms use the same code base and a single fix can be deployed to fix all the other weaknesses, only one endpoint will be considered as eligible for a reward and other reports will be closed as Informative/Duplicate.

Reward amounts are based on:

• Reward grid of the report's scope
• CVSS scoring and actual business impact of the vulnerability upon performing risk analysis

📁 Reports of leaks and exposed credentials

In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and identified outside of our program’s scope, such as:

• Exposed credentials in/from an out-of-scope asset/source
• Sensitive information exposed in/from an out-of-scope asset/source

Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behaviour (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers.

This excludes, but is not limited to:

• Stolen credentials gathered from unidentified sources
• Exposed credentials that are not applicable on the program’s scope
• Exposed GitHub/GitLab (or similar) instance with no direct relation with our program’s scope
• Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program’s scope
• Exposed PII on an out-of-scope asset

To summarize our policy, you may refer to this table :

🚨 Important precautions and limitations

As a complement to the Program’s rules and testing policy :

• DO NOT alter compromised accounts by creating, deleting or modifying any data
• DO NOT use compromised accounts to search for post-auth vulnerabilities (they won’t be eligible anyway)
• DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
• In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
• In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.

🚥 Before to start hunting

Links to download the applications:

• 🍏 iOS: https://apps.apple.com/us/app/france-identit%C3%A9/id1590142959

• 👾 Android : https://play.google.com/store/apps/details?id=fr.gouv.franceidentite&hl=fr&gl=FR&pli=1

📈 DIAGRAMS

Service provider access with a France Identité authentication:

• Mobile process
  

• Web browser process
  

💎 Scenarios with special bounties

To better reflect our context and challenges, we defined several specific scenarios for which you'll be granted a maximum of twice the usual amount for a critical vulnerability (see 'Specific scenarios' scope).

All scenarios MUST follow the general rules of the Bug Bounty.
Please note that Something happens is only for the sake of the example. It can be anything at any given time that is not expected, the team will validate the submitted behavior.

If you find any issue directly related to FranceConnect please report it on the dedicated program as it will be out of the scope of the present program : https://yeswehack.com/programs/franceconnect-agentconnect-public

Scenario #1 Successfully complete the enrolment stage with an Electronic Identity card whose identification data differ from the one belonging to the FranceConnect account - 15K€

e.g. Carry out an enrollment with an electronic identity card with an identity A and a FranceConnect account belonging to an identity B.

Reminder :

• All vulnerabilities exploited on FranceConnect side in order to carry out the attack are out of scope
• You MUST NOT have an account previously enrolled in France Identité with the eletronic identity card used to carry out the attack - You should proceed a first enrollment.

1. Read an electronic identity card on France Identité
2. Choose an enrollment with FranceConnect
3. Choose the identity provider you want
4. Use credentials NOT corresponding to the identity on the electronic identity card ( First name, last name, date and place of birth provided by FranceConnect MUST differ from the data on the electronic identity card)
5. Something happens
6. You define your PIN
7. You are enrolled in France Identité application

Scenario #2 Successfully complete the enrolment stage with another method than an electronic identity card delivered by the ministry of the interior - 25K€

1. Read a fake electronic identity card or any other means on France Identité
2. Choose an enrollment with FranceConnect
3. Choose the identity provider you want
4. Something happens
5. You define your PIN
6. You are enrolled in France Identité application

Scenario #3 Carry out a massive leak of electronic identity card PUK codes - 20K€

1. Use the back-end API
2. Something happens
3. You leak a large amount of electronic identity card PUK codes from France identité

Scenario #4 Successfully complete a forged identity authentication to a service provider federated to FranceConnect with France identité as identity provider - 15K€

Reminder : All vulnerabilities exploited on FranceConnect or service provider side in order to carry out the attack are out of scope

1. Use a service provider federated with FranceConnect
2. Choose France identité as identity provider
3. Two options here :
   • You use a France identité account (no matters which level of assurance, it could be low or high)
     or
   • You try the scenario without a France identité account
4. Something happens
5. You succeed in the authentication : with another identity than the one used for the enrollment (if you previously had an account on France identité) or without having an account in the app France Identité.