{"id":"960b7330-755a-47de-b374-88877585aa8d","engagementId":"6285fcf5-afec-4110-819c-e6b523284d9f","data":{"brief":{"id":"76e39362-9ad5-4a9d-8d1d-bdc31b3d927b","name":"Appliances - Barracuda Networks, Inc.","tagline":"Your Journey, Secured.","description":"\u003cp\u003eBarracuda Networks launched our bug bounty program on November 9, 2010. The response from the research community has been tremendous. Numerous researchers like yourself have contacted us over the years and have made a substantial contribution to our efforts to deliver high-quality security products to our customers.\u003c/p\u003e\n\n\u003cp\u003eThis program focuses on our appliance-based products. Please refer to the \"In Scope Targets\" list below for the current products included in this bounty program.\u003c/p\u003e\n\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\n\u003cp\u003eDocumentation and User's Guides can be found at: \u003ca href=\"https://campus.barracuda.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://campus.barracuda.com/\u003c/a\u003e\u003c/p\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003ch2\u003eCredentials and Access\u003c/h2\u003e\n\n\u003cp\u003eBarracuda does not host any appliances for researchers to test against. As such, we encourage researchers to perform testing using their own appliances. Our appliances are available as virtual machine images, and evaluation licensing is available upon request though our website.\u003c/p\u003e\n\n\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cp\u003eAll Barracuda Networks, Inc. systems and services not listed above are explicitly excluded from the bounty program. This includes, but is not limited to, products hosted for sales demonstration purposes. Any researcher seeking to perform vulnerability testing upon excluded systems must have prior written consent from the Security team at Barracuda Networks, Inc. and should be requested through established Bugcrowd communication channels.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eDenial of Service testing is strictly prohibited on any Barracuda Asset.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eIf you identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Barracuda, it may be reported to this program. Note that this is in the spirit of \"If you see something, say something\" only. Reports of this type are appreciated - but may be marked as 'Not Applicable' and will not be eligible for monetary compensation. \u003cstrong\u003eActive testing\u003c/strong\u003e on all out-of-scope targets is expressly prohibited.\u003c/p\u003e\n\n\u003ch2\u003eThe following bug classes will be considered for monetary rewards\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eUnauthenticated bugs that lead to code execution or authentication bypass.\u003c/li\u003e\n\u003cli\u003eDatapath bugs that lead to code execution.\u003c/li\u003e\n\u003cli\u003eUnauthenticated disclosure of highly sensitive information.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eNote regarding product deficiencies\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eThe program relates to security vulnerabilities in the products. Deficiencies in product functionality are excluded and will be marked as Not Applicable.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eThis includes but is not limited to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eBypasses for the default set of signatures in the Barracuda Web Application Firewall - for example, bypasses for XSS or SQL Injection protection\u003c/li\u003e\n\u003cli\u003eBypasses for content filtering as applied to email or web filtering\u003c/li\u003e\n\u003cli\u003eInaccuracies in content categorization for web filtering\u003c/li\u003e\n\u003cli\u003eBypasses for anti-virus in email or web filtering\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eNote from our legal team\u003c/h2\u003e\n\n\u003cp\u003eThis program is not open to minors, individuals on sanctions lists or individuals in countries on sanctions lists. You are responsible for any tax implications or additional restrictions depending on your country and local law. Barracuda Networks strictly complies with US export laws and regulations. Persons and entities in countries embargoed by the US government or denied from accessing US technology are prohibited from accessing Barracuda Networks systems and participating in this program. We reserve the right to cancel this program at any time and the decision to pay a reward is entirely at our discretion. The decision of Barracuda Networks is final and non-appealable. This offer is void where prohibited by law and in participating, you must not violate any law. You also must not disrupt any service or compromise anyone's data.\u003c/p\u003e\n\n\u003cp\u003eThank you for your interest in the Barracuda Security Bug Bounty Program and for helping Barracuda Networks make our products more secure.\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"2144d01b-45fb-4e9a-b6e5-705fb6f552c1","name":"In scope targets","targets":[{"id":"d44c40a7-390d-46f4-8541-eb7c3e9bd122","uri":"https://www.barracuda.com/products/messagearchiver","name":"Barracuda Message Archiver","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a5d8ca70-4f57-4f47-a3d4-fe93465ecdd6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"85e96c9b-48a9-4c38-9ac9-b0587ad226f4","uri":"https://www.barracuda.com/products/websecuritygateway","name":"Barracuda Web Security Gateway","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6de9b98a-d647-4fd2-b3d4-03e34c7e5386","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"506efbff-ab1e-4459-b696-9dce710acc55","uri":"https://www.barracuda.com/products/loadbalancer?utm_source=google\u0026utm_medium=search_cpc\u0026utm_campaign=387189501\u0026utm_adgroup=116181947964\u0026utm_term=\u0026utm_position=\u0026utm_matchtype=b\u0026utm_device=c\u0026utm_content=484352050459\u0026_bt=484352050459\u0026_bk=\u0026_bm=b\u0026_bn=g\u0026_bg=116181947964\u0026gclid=Cj0KCQjwvr6EBhDOARIsAPpqUPFtfKELYb2ysp1O29NyBMwStaYpYAxq1oso9BaXpcPo9yrcy13uuc0aAtQDEALw_wcB","name":"Barracuda ADC","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"26978654-b94e-45a0-8821-5b0b4fded5b3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e7cb88b0-4b38-4e41-96e3-60c04f6c2173","uri":"https://www.barracuda.com/products/webapplicationfirewall","name":"Barracuda Web Application Firewall","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"551a8ed6-9294-41b7-a94c-dc7681440362","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e50e33a3-5c17-4f07-af9e-47da4f5d07fd","uri":"https://www.barracuda.com/products/emailsecuritygateway","name":"Barracuda Email Security Gateway","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"271f4bb0-57e2-4d4b-b5a6-0df699a7ce2a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"49430c31-ce46-4e68-bdf7-050684b39b0a","uri":"https://www.barracuda.com/products/cloudgenfirewall","name":"Barracuda CloudGen Firewall","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a866e3aa-35f6-4894-a64d-6d1059a3b959","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eAny domain/property of Barracuda not listed here in the targets section is out of scope. This includes any/all products not listed here.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"6285fcf5-afec-4110-819c-e6b523284d9f","code":"barracuda","state":"in_progress","endsAt":null,"bountyId":"d0bbf284-d15b-4fae-9c8f-d856d3c9a152","startsAt":"2014-12-17T14:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/26d8/3c10/571ff01d/a1f415ca2959afc3ccc0800dbb74c777_b3.png","logoBackgroundColor":"#2a2d40","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2014-12-17T14:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/barracuda","changelogs":"/engagements/barracuda/changelog","submissions":null,"announcements":"/engagements/barracuda/announcements","hallOfFame":"/engagements/barracuda/hall_of_fames","crowdstream":null},"announcementsCount":1,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/barracuda/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=barracuda\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/barracuda/engagement_subscribers","engagementChangelogsUrl":"/engagements/barracuda/changelog","publishedAt":"2023-02-28T20:27:23.074Z","engagementChangelogUrl":"/engagements/barracuda/changelog/960b7330-755a-47de-b374-88877585aa8d","createUserFeedbacksUrl":"/engagements/barracuda/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}