TeamViewer - Bounty Program

Company

TeamViewer Germany GmbH is the market leader for remote control.

It has been installed over 2.3 billions time on any type of operating system and provides connectivity for anyone, anywhere, anytime.

Program Rules

• We strongly believe into crowd testing and responsible disclosure model. It helps the industry, it protects users and contributes making the internet a safer place.
• If you believe you've found a security vulnerability in our service, we are happy to work with you to resolve the issue promptly and ensure that you are fairly rewarded for your discovery
• Any type of denial of service attacks is strictly forbidden, as well as any interference with network equipment and TeamViewer Germany GmbH infrastructure. Your work should be non-destructive and remain within a proof of concept framework.

Eligibility and Responsible Disclosure

• We are happy to thank everyone who submits valid reports which help us improve the security of TeamViewer Germany GmbH however, only those that meet the following eligibility requirements may receive a monetary reward:
• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below)
• Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through yeswehack.com
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
• You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
• You must not leak, manipulate, or destroy any user data.
• You must not be a former or current employee of TeamViewer Germany GmbH nor one of its contractor.
• Reports about vulnerabilities are examined and validated by our security analysts.

Scope details

For now, the scope of this program is limited to the following:

TeamViewer Remote

• TeamViewer Remote Client

  • TeamViewer Remote desktop client. Available for free download here: https://www.teamviewer.com/en/products/teamviewer/

• web.teamviewer.com

  • web.teamviewer.com is the web version of the client

• account.teamviewer.com

  • account.teamviewer.com is the associated login service

• login.teamviewer.com

  • login.teamviewer.com is the management console of TeamViewer Remote

• TeamViewer Remote Control App

  • TeamViewer Remote Control App is the mobile version of the TeamViewer client. Available for Android and iOS.

• TeamViewer QuickSupport App

  • TeamViewer QuickSupport App is a mobile client only for incoming remote sessions. Available for Android and iOS.

• Teamviewer Host App

  • Teamviewer Host App is a mobile app for unattended access to a mobile device. Only available for Android.

Backend services you might directly interact with from the client app are considered part of the scope.

License Restriction Bypass – Rewards

All vulnerability reports that demonstrate an issue relying on bypassing our license limitations will be considered as Informative and closed without reward, except if a concrete and severe business impact can be demonstrated. In such instances, it will be a case by case analysis.

The vulnerability leads to a relevant financial impact on the business, can include:

• Noticeable additional infrastructure or service costs
• Persistent and scalable access to high-value, license-restricted features (beyond minor usage extensions or simple account configuration changes)

On the contrary, low impact vulnerabilities include:

• Bypasses limited to minor or isolated increases in usage, such as:
• Adding a small number of additional users/devices within a single account
• Accessing higher-tier features in a non-scalable way
• Cases where the impact is considered negligible from a financial or security perspective