Return to BUG-BOUNTY.md CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / curl / docs

curl

    1: # The curl bug bounty
    2: 
    3: The curl project runs a bug bounty program in association with
    4: [HackerOne](https://www.hackerone.com) and the [Internet Bug
    5: Bounty](https://internetbugbounty.org).
    6: 
    7: # How does it work?
    8: 
    9: Start out by posting your suspected security vulnerability directly to [curl's
   10: HackerOne program](https://hackerone.com/curl).
   11: 
   12: After you have reported a security issue, it has been deemed credible, and a
   13: patch and advisory has been made public, you may be eligible for a bounty from
   14: this program.
   15: 
   16: See all details at [https://hackerone.com/curl](https://hackerone.com/curl)
   17: 
   18: This bounty is relying on funds from sponsors. If you use curl professionally,
   19: consider help funding this! See
   20: [https://opencollective.com/curl](https://opencollective.com/curl) for
   21: details.
   22: 
   23: # What are the reward amounts?
   24: 
   25: The curl projects offer monetary compensation for reported and published
   26: security vulnerabilities. The amount of money that is rewarded depends on how
   27: serious the flaw is determined to be.
   28: 
   29: We offer reward money *up to* a certain amount per severity. The curl security
   30: team determines the severity of each reported flaw on a case by case basis and
   31: the exact amount rewarded to the reporter is then decided.
   32: 
   33: Check out the current award amounts at [https://hackerone.com/curl](https://hackerone.com/curl)
   34: 
   35: # Who is eligible for a reward?
   36: 
   37: Everyone and anyone who reports a security problem in a released curl version
   38: that hasn't already been reported can ask for a bounty.
   39: 
   40: Vulnerabilities in features that are off by default and documented as
   41: experimental are not eligible for a reward.
   42: 
   43: The vulnerability has to be fixed and publicly announced (by the curl project)
   44: before a bug bounty will be considered.
   45: 
   46: Bounties need to be requested within twelve months from the publication of the
   47: vulnerability.
   48: 
   49: The vulnerabilities must not have been made public before February 1st, 2019.
   50: We do not retroactively pay for old, already known, or published security
   51: problems.
   52: 
   53: # Product vulnerabilities only
   54: 
   55: This bug bounty only concerns the curl and libcurl products and thus their
   56: respective source codes - when running on existing hardware. It does not
   57: include documentation, websites, or other infrastructure.
   58: 
   59: The curl security team will be the sole arbiter if a reported flaw can be
   60: subject to a bounty or not.
   61: 
   62: # How are vulnerabilities graded?
   63: 
   64: The grading of each reported vulnerability that makes a reward claim will be
   65: performed by the curl security team. The grading will be based on the CVSS
   66: (Common Vulnerability Scoring System) 3.0.
   67: 
   68: # How are reward amounts determined?
   69: 
   70: The curl security team first gives the vulnerability a score, as mentioned
   71: above, and based on that level we set an amount depending on the specifics of
   72: the individual case. Other sponsors of the program might also get involved and
   73: can raise the amounts depending on the particular issue.
   74: 
   75: # What happens if the bounty fund is drained?
   76: 
   77: The bounty fund depends on sponsors. If we pay out more bounties than we add,
   78: the fund will eventually drain. If that end up happening, we will simply not
   79: be able to pay out as high bounties as we would like and hope that we can
   80: convince new sponsors to help us top up the fund again.
   81: 
   82: # Regarding taxes, etc. on the bounties
   83: 
   84: In the event that the individual receiving a curl bug bounty needs to pay
   85: taxes on the reward money, the responsibility lies with the receiver. The
   86: curl project or its security team never actually receive any of this money,
   87: hold the money, or pay out the money.
   88: 
   89: ## Bonus levels
   90: 
   91: In cooperation with [Dropbox](https://www.dropbox.com) the curl bug bounty can
   92: offer the highest levels of rewards if the issue covers one of the interest
   93: areas of theirs - and only if the bug is graded *high* or *critical*. A
   94: non-exhaustive list of vulnerabilities Dropbox is interested in are:
   95: 
   96:  - RCE
   97:  - URL parsing vulnerabilities with demonstrable security impact
   98: 
   99: Dropbox would generally hand out rewards for critical vulnerabilities ranging
  100: from 12k-32k USD where RCE is on the upper end of the spectrum.
  101: 
  102: URL parsing vulnerabilities with demonstrable security impact might include
  103: incorrectly determining the authority of a URL when a special character is
  104: inserted into the path of the URL (as a hypothetical). This type of
  105: vulnerability would likely yield 6k-12k unless further impact could be
  106: demonstrated.