codefortynine

This bounty is part of the Atlassian Marketplace Bounty Program

codefortynine builds integration applications for software development teams using Atlassian's Jira platform.

Get Started (tl;dr version)

• Do not access, impact, destroy or otherwise negatively impact codefortynine or Atlassian customers, or customer data in any way.
• Do not create support requests on codefortynine.atlassian.net. Failure to adhere to this will result in not receiving any reward for any of your submissions and possible removal from the program.
• Do not post reviews for our apps on marketplace.atlassian.com. Failure to adhere to this will result in not receiving any reward for any of your submissions and possible removal from the program.
• Please do not test codefortynine.atlassian.net or marketplace.atlassian.com, but install our apps in your Jira instance and test the apps themselves. Otherwise we will close your submission as "out of scope".
• Ensure that you use your @bugcrowdninja.com email address.
• Ensure you understand the targets, scopes, exclusions, and rules below.
• If you have questions, please reach out to support@bugcrowd.com.

Quick Links

• Deep Clone for Jira
• Merge Agent for Jira
• Quick Filters for Jira Dashboards
• Comment Custom Fields for Jira
• External Data for Jira Fields
• External Data for Jira Fields - Extension
• Secure Google Calendar for Confluence
• Snipe It for Jira
• Version Sync for Jira
• Slack for Confluence
• Comment History Log for Jira
• External Data for Confluence
• Jamf for Jira
• Dynamic Fields for Jira
• Advanced Bulk Edit for Jira
• Prime Custom Fields for Jira
• Easy Confluence Gadget for Jira Dashboards

Focus Areas

Below is a list of some of the vulnerability classes that we are seeking reports for:

• Cross Instance Data Leakage/Access**
• Server-side Remote Code Execution (RCE)
• Server-Side Request Forgery (SSRF)
• Stored/Reflected Cross-site Scripting (XSS)
• Cross-site Request Forgery (CSRF)
• SQL Injection (SQLi)
• XML External Entity Attacks (XXE)
• Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc)
• Path/Directory Traversal Issues

Ensure you review the out of scope and exclusions list for further details.

** Cross Instance Data Leakage/Access refers to unauthorized data access between instances.

Please ensure you're being non-destructive whilst testing and are only testing using accounts and instances created via the instructions under "Creating your instance". Any testing/spamming live support portals or Marketplace sites will disqualify you and you will be banned from Atlassian programs.

---

Ratings/Rewards:

For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. codefortynine uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, codefortynine will defer to the CVSS score to determine the priority. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.