March 2021 Summaries

In our tenth release of the Vulnerability Rating Taxonomy (VRT), we're continuing to meet our goals by collaborating with the community, maintaining a taxonomy that reflects the latest ecosystem changes, and enabling vulnerability category-based workflows through ease of mapping. We've partnered with Stellantis to add twenty automotive-specific vulnerabilities, which builds upon previous efforts to support the Automotive Security Misconfiguration category. With Adobe Flash's end-of-life announcement, we've downgraded all Flash-based entries to P5 due to strong mitigation plans upstream at browsers. We've also partnered with Secure Code Warrior to link our categories to their applicable training, leveraging mappings to VRT for easy access to CWE, CVSS, and remediation advice. The new version will be available throughout the platform the week of April 12th, including updated submissions forms, reporting, filtering, and a Ruby client. Over the past four years, we've seen over a hundred issues opened up to the community, driving updates to improve categorization, impact, and remediation understanding across all users.

Cross-Site Scripting (XSS) is a common vulnerability in web applications that allows an attacker to execute client-side JavaScript in another user's browser, potentially leading to session hijacking, sensitive action bypass, and other malicious activities. XSS can range from minor to critical severity and is challenging to prevent due to its dynamic nature. Gaining access to an XSS vulnerability enables attackers to steal session tokens, bypass Same Origin Policy (SOP), exfiltrate information, and perform sensitive actions as if logged in by the victim user. The root cause of XSS vulnerabilities lies in the improper escape of user input when reflected back to the application, allowing client-side JavaScript to be injected and executed. XSS can be categorized into different types, including Reflected XSS, Persistent/Stored XSS, DOM XSS, and Self-XSS. Context is crucial in understanding how user input may be injected into various contexts, such as HTML tags, attributes, comments, event handlers, URLs, and scripts. To discover XSS vulnerabilities, manual testing, XSS polyglots, automated scanners, and basic filter bypasses are used. Once an XSS vulnerability is identified, it can be escalated using methods like including longer payloads, bypassing the SOP, and taking over user accounts. Other cases of XSS include length-limited payloads, link injection, referer header XSS, and RCE via XSS in Electron apps. Understanding these concepts and techniques is essential for identifying and mitigating XSS vulnerabilities in web applications.

Regular Expressions (regex) are a powerful tool for searching and manipulating text patterns. Once mastered, regex can greatly improve efficiency in everyday tasks such as parsing URLs, filtering large chunks of text, and validating input data. A key concept in regex is the use of quantifiers to specify how many times a pattern should be matched, with common quantifiers including `*` (zero or more), `+` (one or more), and `?` (once or not at all). Lookbehinds and lookaheads can also be used to check for specific conditions without including them in the match. Additionally, regex can be used to bypass security controls by exploiting edge cases, and it's generally recommended to use allowlists instead of custom regex for input validation. With practice and patience, developers can become proficient in using regex to extract useful information from text data.

We've started a community-driven, curated collection of bug bounty resources called Bugcrowd Tip Jar, hosted as a Github repository, to provide a more reliable source of high-quality information for researchers. The platform aims to collect valuable tips, tools, and resources through community contributions, with the goal of providing a one-stop-shop for bug bounty hunting and hacking education.

The Bugcrowd platform is making changes to its "Won't Fix" outcome to be more neutral and accurate, shifting it to an "Informational" state. This change will occur gradually over a few weeks, with the old meaning still being used for backward compatibility. The shift aims to clarify the distinction between "won't fix" and "can't fix", as the latter implies physical capability and subtext of not wanting to do something. The new "informational" state is considered more neutral and widely accepted in the security industry, with clearer positioning as an accepted end-state for submissions. This change aims to improve clarity, accuracy, and happiness among researchers and customers, particularly in cases where the distinction between "won't fix" and "can't fix" is crucial.

Happy International Women’s Day! This year's theme is #ChooseToChallenge, highlighting everyone's individual responsibility to challenge and call out gender inequality to create a more inclusive world. The pandemic has disproportionately impacted women, with four times as many women as men leaving the labor force last year. Bugcrowd CEO Ashish Gupta encourages celebrating and taking action to challenge the status quo and promote equality. At Bugcrowd, an employee resource group called SHE is working to increase women in cybersecurity, recruiting more women into the industry, and creating mentorship programs, educational events, and networks to empower women. Despite challenges, including imposter syndrome and discrimination, women are taking collective action to promote themselves and each other, with tips on how to celebrate International Women's Day, such as advocating for gender equality at work, supporting women-owned businesses, and recognizing contributions of women in their lives.

The P1 Warrior Program is an incentive program that rewards researchers for their total count of valid P1 submissions since January 1, 2019. The program recognizes brave and experienced soldiers who specialize in combat, specifically in bug hunting and vulnerability disclosure. Researchers who have submitted a certain number of P1 reports are rewarded with exclusive items such as the Champion Wrestling Belt, P1 Warrior Hoodie, and Challenge Coin. The rewards vary based on the level of submissions made by each researcher, ranging from 10+ P1s for Level 3 Warriors to 250+ P1s for Level 6, 7 & 8 Warriors. To be included in future announcements, researchers' profiles must be set to "Public".

Bugcrowd's MVP (Most Valuable Player) program recognizes researchers who consistently demonstrate exceptional technical abilities and outstanding submissions on the platform. The program rewards individuals who maintain high accuracy rates, achieve priority percentile ranges above 80%, submit multiple qualifying submissions, and adhere to enforcement policies. Bugcrowd celebrates its top-performing researchers every quarter, with a special shoutout to those who achieve MVP status for four consecutive quarters or three quarters in a row. The program aims to encourage and reward the best of the best among researchers on the platform, making the internet a safer place through their contributions.

Atlassian ran a project on Bugcrowd looking for bugs in their proposed implementation of Kata Containers within the Bitbucket Pipelines CI/CD environment. Researchers identified vulnerabilities that could allow processes running in the Kata VM to write to supposedly read-only volume mounts, potentially allowing malicious build jobs to execute arbitrary commands on the host system. The vulnerability was fixed by the Kata Containers team and assigned CVE-2020-28914. The impact of this vulnerability is significant, as it allows an attacker to interfere with any customer's pipeline builds on the same host, potentially leading to a Denial-of-Service (DoS) attack. Researchers were able to exploit this vulnerability by manipulating a read-only hostPath volume, which allowed them to write to arbitrary files on the container host and execute malicious commands. The vulnerability was eventually fixed by applying a fix in the Pipelines environment, but not before researchers had identified and exploited it, demonstrating the potential for bug bounty programs to identify critical security vulnerabilities.