Ooredoo QPSC - Customer Portal Bug Bounty Program

Please use the program’s user agent, it allows us to triage your reports with more ease so to respond to you as fast as possible.

About

Ooredoo QPSC

We (Ooredoo QPSC) are a Qatari multinational telecommunications company headquartered in Doha, Qatar. We provide mobile, wireless, wire line, and content services with market share in domestic and international telecommunication markets, and in business (corporations and individuals) and residential markets.
Security is very important to us and this Bug Bounty program shall help us meet highest industry standards to offer the most secure service and experience to all parties.

Ooredoo Portal

Customers can manage subscription using this app. With the Ooredoo app, customers can check balances, recharge and pay phone bills and manage Loyalty account. More details: https://www.ooredoo.qa/

Ooredoo App

Customers can manage subscription using this app. With the Ooredoo app, customers can check balances, recharge and pay phone bills and manage Loyalty account. More details: https://www.ooredoo.qa/web/en/ooredoo-app/

Program Rules

Testing Policy and Responsible Disclosure

Please adhere to the following rules while performing research on this program:

• Denial of service (DoS) attacks on Ooredoo QPSC applications, servers, networks or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic.
• Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
• Do not copy any files from our applications/servers or disclose them.
• No vulnerability disclosure, full, partial or otherwise, is allowed.
• Notify Ooredoo immediately if you discover any evidence of a breach of Ooredoo’s systems apart from your own tests.
• We strive to review submitted vulnerabilities reports within 4 weeks.
• Ooredoo will not pursue legal action against researchers who report vulnerabilities within the terms of company’s reporting mechanism.

By participating to this program :

• You agree not to disclose to any third party any information related to your report, the vulnerabilities and/or errors reported, nor the fact that a vulnerabilities and/or errors has been reported to Ooredoo.
• You agree to indemnify and hold Ooredoo harmless against all claims, losses, demands, proceedings, fines, and expenses arising from or related to your violation of these rules.
• Unless otherwise required under applicable law or regulation, Ooredoo has no responsibility to pay you compensation for any direct, indirect, or consequential losses, property damage, financial loss, loss of productivity, information that is lost or corrupted, regardless of whether such loss could have been foreseen, or any other loss that is not due to Ooredoo’s gross negligence.
• You agree that these terms and conditions will be governed by the laws of the State of Qatar and you consent to the jurisdiction of the courts of Qatar, which will have exclusive jurisdiction over any dispute arising hereunder.

Reward Eligibility

We are happy to thank everyone who submits valid reports which help us improve the security of Ooredoo QPSC, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and Ooredoo QPSC, and remediation advice on fixing the vulnerability;
  • Proof of exploitation: screenshots demonstrating the exploit was performed, and showing the final impact;
  • Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc.
• You must not break any of the testing policy rules listed above.
• You must not be a former or current employee of Ooredoo QPSC or one of its contractors.
• If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded accordingly to your findings.
• The triage team will use the "One Fix One Reward" process: if two or more endpoints use the same code base and a single fix can be deployed to fix all the others weaknesses, only one endpoint will be considered as eligible for a reward and other reports will be closed as 'informative'.

Reward amounts are based on:

• Reward grid of the report's scope;
• CVSS scoring and actual business impact of the vulnerability upon performing risk analysis.

Reports of leaks and exposed credentials

In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and identified outside of our program’s scope, such as:

• Exposed credentials in/from an out-of-scope asset/source
• Sensitive information exposed in/from an out-of-scope asset/source

Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behaviour (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers.

This excludes, but is not limited to:

• Stolen credentials gathered from unidentified sources
• Exposed credentials that are not applicable on the program’s scope
• Exposed GitHub/GitLab (or similar) instance with no direct relation with our program’s scope
• Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program’s scope
• Exposed PII on an out-of-scope asset

To summarize our policy, you may refer to this table :

	Source of leak is in-scope	Source of leak belongs to our organization but is out-of-scope	Source of leak does not belong to our organization and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset)	Eligible	Eligible	Not Eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset)	Eligible	Not Eligible	Not Eligible

Important precautions and limitations

As a complement to the Program’s rules and testing policy :

• DO NOT alter compromised accounts by creating, deleting or modifying any data
• DO NOT use compromised accounts to search for post-auth vulnerabilities (they won’t be eligible anyway)
• DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
• In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
• In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.