Skip to content

Commit 8636e32

Browse files
tomrittervgtomrittervg
authored
Update the bug bounty policy (#17331)
1 parent 158c3a7 commit 8636e32

3 files changed

Lines changed: 31 additions & 78 deletions

File tree

‎bedrock/security/templates/security/client-bug-bounty.html‎

Lines changed: 19 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -38,53 +38,37 @@ <h2 id="security-vulnerability-bounty">Security Vulnerability Bounty</h2>
3838

3939
<p>All bounties paid will be at the discretion of the Mozilla Bounty Committee. The committee will evaluate the severity of reported issues with the help of engineers who work on the affected code. Security researchers are invited to participate in the assignment of ratings, but final decisions on the rating are at the discretion of the Bounty Committee.</p>
4040

41-
<p>Typically, the security rating given by the Bounty Committee for a bug must be rated a "sec-high" or "sec-critical" in order for it to be eligible for a bounty. In some circumstances, bounties may be paid for lower-rated bugs as well. (See <a href="https://wiki.mozilla.org/Security_Severity_Ratings/Client">Security Ratings</a> for details of the rating qualifications.) </li>
41+
<p>Typically, the security rating given by the Bounty Committee for a bug must be rated a "sec-high" or "sec-critical" in order for it to be eligible for a bounty. In some circumstances, bounties may be paid for lower-rated bugs as well. (See <a href="https://wiki.mozilla.org/Security_Severity_Ratings/Client">Security Ratings</a> for details of the rating qualifications.) </p>
4242

4343
<h4 id="security-vulnerability-amounts">Rewards Amount</h4>
4444

45-
<p>The bounty for valid potentially exploitable critical and high security rated client security vulnerabilities will be between $20,000 and $3,000 (USD) cash reward, depending on the impact of the vulnerability and the quality of the report, as detailed below.</p>
45+
<p>The bounty for a valid, potentially exploitable client security vulnerability rated critical or high is up to $20,000 (USD) cash, depending on the impact of the vulnerability and the quality of the report, as detailed below.</p>
4646

47-
<p>The bounty program encourages the <u>earliest possible reporting</u> of potentially exploitable bugs. A bounty <u>is not determined based on the <i>initial</i> submission</u>, but rather on the outcome of the discussion with developers. Improving test cases post-submission, figuring out if an engineer's speculation is founded or not, or other assistance that helps resolve the issue <i>will</i> increase your bounty payout.</p>
47+
<p>The bounty program encourages the <u>earliest possible reporting</u> of potentially exploitable bugs. A bounty <u>is not determined based on the <i>initial</i> submission</u>, but rather on the outcome of the discussion with developers. Improving test cases post-submission, figuring out if an engineer's speculation is founded or not, or other assistance that helps resolve the issue can increase your bounty payout.</p>
4848

49-
<p><b>Baseline Report</b></p>
50-
<ul class="mzp-u-list-styled">
51-
<li>Sufficient information to diagnose the vulnerability and produce a fix. Examples:</li>
52-
<ul class="mzp-u-list-styled">
53-
<li>ASAN Stacktrace or Crash Dump (typically for Memory Trespassing/Corruption) including a testcase that reproduces that output</li>
54-
<li>Trigger point (for UXSS)</li>
55-
</ul>
56-
<li>Notes:</li>
57-
<ul class="mzp-u-list-styled">
58-
<li>Typically bounties are not paid for issues which cannot be identified/fixed from the report.</li>
59-
<li>While we do adhere to a first reporter-rule (with a 48-hour collision window), exceptions are made for reports that are not actionable and require additional information provided by another party.</li>
60-
<li>A report should not have severity keywords set or include CVSS scores or CWEs.</li>
61-
</ul>
62-
</ul>
63-
64-
<p><b>High Quality Report</b></p>
49+
<p><b>Report Criteria</b></p>
6550

6651
<ul class="mzp-u-list-styled">
67-
<li>Includes at least two of the following:</li>
52+
<li>A report should provide sufficient information to diagnose the vulnerability and produce a fix, and must include a simple, reproducible test case demonstrating the issue and at least one of the following:</li>
6853
<ul class="mzp-u-list-styled">
69-
<li>(for memory corruption) demonstrated control over the PC or memory read/write location, with documentation for how it is achieved</li>
70-
<li>a root cause analysis of where the bug is located</li>
71-
<li>a proof of concept that reproduces the vulnerability, easily integrated into our test suite</li>
54+
<li>an ASAN stacktrace or crash dump (typically for memory trespassing/corruption)</li>
55+
<li>a root cause analysis of how the bug occurs or where the bug is located</li>
7256
</ul>
73-
<li>Submissions that include some aspects of a high quality report will qualify for a bounty between the minimum and maximum.</li>
7457
<li>Notes:</li>
7558
<ul class="mzp-u-list-styled">
76-
<li>A bug that is limited in capability may meet all the criteria for a High Quality report, but will merit a lower payout because of its limited capability. An example would be a sandbox escape that does not allow arbitrary code execution, but does allow arbitrary files to be read from the filesystem.</li>
77-
<li>Developing a full exploit is not required for a High Quality Report.</li>
78-
<li>The intent of the proof of concept is to enable us to create a test that we can integrate into our test coverage. We encourage you to submit the bug immediately, and if you wish to meet this criteria, ask what will qualify. For assertion/crash-based tests it is usually sufficient to provide a minimal reproducing html or js file. For more complicated bugs, we would ask you to develop the POC into an actual test (e.g. gtest, xpcshell, mochitest) which we can provide some mentorship for.</li>
59+
<li>Bounties are not paid for issues which cannot be identified or fixed from the report.</li>
60+
<li>A bug that is limited in capability or affects a limited set of users will merit a lower payout. An example would be a sandbox escape that does not allow arbitrary code execution, but does allow arbitrary files to be read from the filesystem.</li>
61+
<li>Developing a full exploit is not required.</li>
62+
<li>While we do adhere to a first reporter-rule (with a 48-hour collision window), exceptions are made for reports that are not actionable and require additional information provided by another party.</li>
63+
<li>A report should not set severity keywords or include CVSS scores.</li>
7964
</ul>
8065
</ul>
8166

8267
<table class="mzp-u-data-table">
8368
<thead>
8469
<tr>
8570
<th></th>
86-
<th>High Quality Report</th>
87-
<th>Baseline: up to</th>
71+
<th>Up to</th>
8872
</tr>
8973
</thead>
9074
<tbody>
@@ -93,7 +77,6 @@ <h4 id="security-vulnerability-amounts">Rewards Amount</h4>
9377
<td>Highest Impact
9478
</td>
9579
<td>$20,000</td>
96-
<td>$18,000</td>
9780
</tr>
9881
<tr>
9982
<td>
@@ -113,7 +96,6 @@ <h4 id="security-vulnerability-amounts">Rewards Amount</h4>
11396
<tr>
11497
<td>Higher Impact</td>
11598
<td>$10,000</td>
116-
<td>$8,000</td>
11799
</tr>
118100
<tr>
119101
<td>
@@ -124,50 +106,22 @@ <h4 id="security-vulnerability-amounts">Rewards Amount</h4>
124106
</tr>
125107
<!-- ========================================================= -->
126108
<tr>
127-
<td>High Impact - Vulnerabilities not fitting 'Higher' or 'Highest Impact', but still receiving a <a href="https://wiki.mozilla.org/Security_Severity_Ratings/Client">sec-high rating</a>
109+
<td>High Impact
128110
</td>
129-
<td>$5,000</td>
130111
<td>$3,000</td>
131112
</tr>
132113
<tr>
133114
<td>
134115
<ul class="mzp-u-list-styled">
135-
<li>sec-high rated address bar spoofs</li>
116+
<li><a href="https://wiki.mozilla.org/Security_Severity_Ratings/Client">sec-high rated</a> vulnerabilities in supported configurations that fall within our threat model</li>
136117
<li>Memory corruption in the GPU process</li>
137-
<li>Information disclosure from the parent to a less privileged process (e.g. out-of-bounds memory reads via IPC)</li>
118+
<li>Information disclosure from the parent to a web content process (e.g. out-of-bounds memory reads via IPC)</li>
138119
</ul>
139120
</td>
140-
<td class="two-col-cell" colspan="2">
141-
<span>Typically $3000</span>
142-
</td>
143121
</tr>
144122
<!-- ========================================================= -->
145123
<tr>
146-
<td>Moderate Impact, at the discretion of the committee
147-
</td>
148-
<td class="two-col-cell first-of-section" colspan="2">
149-
<span>$2,500 - $500</span>
150-
</td>
151-
</tr>
152-
<tr>
153-
<td>
154-
<ul class="mzp-u-list-styled multiple-item-list">
155-
<li>Memory Corruption triggered by an OOM condition<sup>3</sup></li>
156-
</ul>
157-
</td>
158-
<td class="two-col-cell" colspan="2">
159-
<span>Typically $1,500</span>
160-
</td>
161-
</tr>
162-
<tr>
163-
<td>
164-
<ul class="mzp-u-list-styled">
165-
<li>Persistent-DOS of browser across restarts or a DOS requiring reboot of user’s computer<sup>4</sup></li>
166-
</ul>
167-
</td>
168-
<td class="two-col-cell" colspan="2">
169-
<span>Typically $1,000</span>
170-
</td>
124+
<td colspan="2">Exceptional Moderate Impact vulnerabilities paid at the discretion of the committee</td>
171125
</tr>
172126
</tbody>
173127
</table>
@@ -178,10 +132,6 @@ <h4 id="security-vulnerability-amounts">Rewards Amount</h4>
178132

179133
<p><sup>2</sup>UXSS is defined as the ability to execute JavaScript in an arbitrary cross-origin context. As mentioned above, complex user interaction or limited capabilities of the vulnerability (such as requiring a compromised content process; or only being able to inject into a cross-origin domain, but not an arbitrary cross-origin domain) will decrease the bounty award.</p>
180134

181-
<p><sup>3</sup> If precise control of the OOM condition can be demonstrated, this will be considered High Impact.</p>
182-
183-
<p><sup>4</sup> Denial of Service issues that merely crash the browser are not eligible for a bounty.</p>
184-
185135
<h2 id="exploit-mitigation-bounty">Exploit Mitigation Bug Bounty</h2>
186136

187137
<p>Within Firefox, we have introduced vital security features, exploit mitigations, and defense in depth measures. If you are able to bypass one of these measures, even if you are operating from privileged access within the browser, you are eligible for a bounty.</p>
@@ -218,9 +168,9 @@ <h2 id="exploit-mitigation-bounty">Exploit Mitigation Bug Bounty</h2>
218168
<li>Other things may be considered a mitigation as well, but before assuming they would be, please confirm with us in #security or at <a href="mailto:security@mozilla.org">security@mozilla.org</a></li>
219169
</ul>
220170

221-
<p><strong>Bounty</strong>: Assuming the mitigation is bypassed in a testing scenario, with privileged access, we will treat a bypass of the above listed mitigations as High Impact using the table above, with the same payout range for baseline to high quality report.</p>
171+
<p><strong>Bounty</strong>: Assuming the mitigation is bypassed in a testing scenario, with privileged access, we will treat a bypass of the above listed mitigations as High Impact using the table above.</p>
222172

223-
<p><strong>Bounty Bonus</strong>: If the mitigation is bypassed without privileged access, this would count as both a regular security vulnerability eligible for a bounty and a mitigation bypass. The vulnerability payout will be decided per the criteria and table above and the mitigation bypass adds a bonus of an additional 50% of the baseline payout for the category. e.g. a UXSS vulnerability that bypasses our HTML sanitization would earn $8K - $10K plus an additional $4000.</p>
173+
<p><strong>Bounty Bonus</strong>: If the mitigation is bypassed without privileged access, this would count as both a regular security vulnerability eligible for a bounty and a mitigation bypass. The vulnerability payout will be decided per the criteria and table above and the mitigation bypass adds a bonus of an additional 50% of the payout for the category. For example, a UXSS vulnerability that bypasses our HTML sanitization would earn its UXSS payout of up to $10,000 plus an additional 50%.</p>
224174

225175
<p><em>Note</em>: If you’re in the Bounty Bonus category, you may think submitting them separately could earn you slightly more money than submitting them together. We’re pretty sure that doing so would make the second report bounty-ineligible, but if you think each issue is fully independent, you’re welcome to submit them separately and we’ll consider it.</p>
226176

‎bedrock/security/templates/security/index.html‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -114,10 +114,12 @@ <h2 id="For_Developers">For Developers: Contacting Mozilla</h2>
114114
products:</p>
115115

116116
<ul class="mzp-u-list-styled">
117-
<li><strong>If you believe that you've found a Mozilla-related
118-
security vulnerability, please report it by sending email to the
119-
address <a href="mailto:security@mozilla.org">security@mozilla.org</a>.</strong> Note that your report may be
120-
eligible for a reward; see below.
117+
<li><strong>If you believe that you've found a security vulnerability in a
118+
Mozilla product or service, please report it through our
119+
<a href="{{ url('security.bug-bounty') }}">Security Bug Bounty Program</a></strong>,
120+
which explains how to submit client bugs (via Bugzilla) and web and
121+
services bugs (via HackerOne). Please do not send vulnerability details by
122+
email.
121123
</li>
122124
<li>For more information on how to report security vulnerabilities
123125
and how the Mozilla community will respond to such reports, see our

‎media/css/security/client-bug-bounty.scss‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,16 @@
1010
margin-top: $spacing-xl;
1111
}
1212

13-
ul.multiple-item-list {
14-
margin-bottom: 0;
13+
// Keep an example row's amount cell visually grouped with its list cell.
14+
tr:has(> td > ul) td {
15+
border-top: 0;
1516
}
1617

17-
td.two-col-cell {
18+
td[colspan] {
1819
text-align: center;
1920
}
2021

21-
td.two-col-cell:not(.first-of-section) {
22-
border-top: 0;
22+
ul.multiple-item-list {
23+
margin-bottom: 0;
2324
}
2425
}

0 commit comments

Comments
 (0)