{"id":"b9f52550-a5a5-41d6-979e-89a663bd9ce7","engagementId":"7f8b389e-3d24-4f17-a4fc-ec2ef1697987","data":{"brief":{"id":"80b09624-24a9-40da-9e6b-c33b77bead9c","name":"CoStar Vulnerability Disclosure Engagement","tagline":"Discover the significance of the gold standard in commercial real estate, emphasizing the essential tools, resources, trend forecasts, and thought leadership necessary for real estate professionals to make informed, data-driven decisions.","description":"\u003cp\u003eCoStar Group is a global leader in commercial real estate information, analytics, online marketplaces, and 3D digital twin technology. Founded in 1986, CoStar Group is dedicated to digitizing the world’s real estate, empowering all people to discover properties, insights, and connections that improve their businesses and lives.\u003c/p\u003e\n\n\u003cp\u003eCoStar Group’s major brands include CoStar, a leading global provider of commercial real estate data, analytics, and news; LoopNet, the most trafficked commercial real estate marketplace; Apartments.com, the leading platform for apartment rentals.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eRatings\u003c/strong\u003e\u003cbr\u003e\nFor the initial prioritization/rating of findings, this engagement will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/p\u003e","industryTagId":"f7d6118f-e788-4bb7-a2a6-7078424c9d3c","targetsOverview":"\u003cp\u003e\u003cstrong\u003eOut of Scope\u003c/strong\u003e\u003cbr\u003e\nIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Apartments.com, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003ch2\u003eOut-of-Scope/Exclusion\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePlease do not submit contact forms, create support tickets, send emails, etc. that will generate work for a human outside of the security team. Use your @bugcrowdninja.com email if needed for research-related work.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVolume-related issues (e.g. brute force, rate limiting, DoS/DDoS).\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003eAny attacks on our customers or end users\u003c/li\u003e\n\u003cli\u003eUse of stolen/breached user credentials.\u003c/li\u003e\n\u003cli\u003eDo not modify, delete/destroy or retain CoStar or CoStar customers' data.\u003c/li\u003e\n\u003cli\u003eSocial engineering, phishing, or physical testing (e.g. premises, equipment).\u003c/li\u003e\n\u003cli\u003eResearchers should not pursue post-exploitation unless explicitly approved.\u003c/li\u003e\n\u003cli\u003eAttacks against social media or third party services that Domain use (LinkedIn, Twitter, etc.)\u003c/li\u003e\n\u003cli\u003eVulnerabilities affecting users of outdated browsers.\u003c/li\u003e\n\u003cli\u003eCookie flags i.e. Secure, HTTPOnly.\u003c/li\u003e\n\u003cli\u003eAbsent or misconfigured HTTP headers ie. Content-Security-Policy, Strict-Transport-Security, X-XSS-Protection, Cache-Control.\u003c/li\u003e\n\u003cli\u003eClickjacking i.e. missing X-Frame-Options header.\u003c/li\u003e\n\u003cli\u003eEmail configuration e.g. SPF, DKIM, DMARC.\u003c/li\u003e\n\u003cli\u003eError pages i.e. verbose error messages, stack traces, invalid status codes.\u003c/li\u003e\n\u003cli\u003eFunctional, UI and UX bugs and spelling mistakes.\u003c/li\u003e\n\u003cli\u003eConfiguration that is not directly exploitable i.e. weak TLS ciphers, password policy, session expiration, certificate pinning, Security headers divulging software version information, WordPress users etc..\u003c/li\u003e\n\u003cli\u003eNo large scale, intrusive or blind automated scanning.\u003c/li\u003e\n\u003cli\u003eNon-sensitive exposed API keys e.g. Google Maps, Raygun.\u003c/li\u003e\n\u003cli\u003eGeneric vulnerability scan results without proof of concept or a clear path to exploitation.\u003c/li\u003e\n\u003cli\u003eThe use of personal credentials, your own or discovered, for testing purposes is allowed. If you have any questions regarding this matter, please contact \u003ca href=\"https://bugcrowd-support.freshdesk.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eour support portal.\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eIDORs or Searches, that return Agent or Property information. Agents PAY to be returned higher in searches and property information is made available to perspective buyers.\u003c/li\u003e\n\u003cli\u003eEXIF Geolocation Findings\u003c/li\u003e\n\u003cli\u003eHTML Injection on 3rd Party Website (e.g. Gmail)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003eCredentials\u003c/strong\u003e\u003cbr\u003e\nTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003e\u003cstrong\u003eSafe Harbor\u003c/strong\u003e\u003cbr\u003e\nWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/login\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal \u003c/a\u003ebefore going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"894f3da2-8a20-43b8-b90b-4c598a5a09f3","name":"In Scope","targets":[{"id":"a41dab66-acd4-42cf-817d-56d76e6967b0","uri":"https://www.apartments.com","name":"Apartments.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"69108817-1fb8-49ec-9bb4-89ffd62ebc2f","sortOrder":0},"sortOrder":0,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"a41dab66-acd4-42cf-817d-56d76e6967b0"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"a41dab66-acd4-42cf-817d-56d76e6967b0"}],"recentChangeFlags":null},{"id":"c07ea306-952e-4954-bc72-db752b798592","uri":"https://auth.apartments.com/ ","name":"Apartments.com Authentication","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9104c34a-f1fb-478a-976c-0a4b4abd9ac6","sortOrder":1},"sortOrder":1,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"c07ea306-952e-4954-bc72-db752b798592"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"c07ea306-952e-4954-bc72-db752b798592"}],"recentChangeFlags":null},{"id":"61b98f80-4213-49de-a018-1c7d3481401b","uri":"https://account.apartments.com/ ","name":"Apartments.com Payment Service","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6ac3390a-1242-4732-8c70-3c23a7bc3348","sortOrder":2},"sortOrder":2,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"61b98f80-4213-49de-a018-1c7d3481401b"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"61b98f80-4213-49de-a018-1c7d3481401b"}],"recentChangeFlags":null},{"id":"542f2bdf-c059-4d0f-bfab-d085e1bda412","uri":"https://www.loopnet.com/ ","name":"Loopnet","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"02ba52ca-c0a1-4d82-a3e1-a026f2771e35","sortOrder":3},"sortOrder":3,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"542f2bdf-c059-4d0f-bfab-d085e1bda412"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"542f2bdf-c059-4d0f-bfab-d085e1bda412"}],"recentChangeFlags":null},{"id":"ff4196e1-759f-4b47-85a6-c72a496708db","uri":"https://auth.loopnet.com/ ","name":"Loopnet Authentication","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3c2ffc1f-c922-4afe-bebc-ca4e67a3e004","sortOrder":4},"sortOrder":4,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"ff4196e1-759f-4b47-85a6-c72a496708db"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"ff4196e1-759f-4b47-85a6-c72a496708db"}],"recentChangeFlags":null},{"id":"4706e8a5-304e-4562-b9ef-6262532cd1ac","uri":"https://account.loopnet.com","name":"Loopnet Payment Services","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c56ffd5c-57b5-4b50-8731-c18f2fd8ca52","sortOrder":5},"sortOrder":5,"tags":[{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"4706e8a5-304e-4562-b9ef-6262532cd1ac"},{"id":"9ffd297c-4781-4777-94cf-ef4e2ddda266","name":"C#","targetId":"4706e8a5-304e-4562-b9ef-6262532cd1ac"}],"recentChangeFlags":null},{"id":"3ac108ad-b207-4739-a42e-3976eeb90064","uri":"https://accout.costar.com","name":"CoStar Suite Payment Services","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e05c7f5-6c84-48dd-858e-719b05df3876","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3ac108ad-b207-4739-a42e-3976eeb90064"}],"recentChangeFlags":null},{"id":"9d38668c-03bd-4162-9cde-a519b3c123fa","uri":"https://www.after55.com","name":"After 55","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7f1234c2-0b6a-48a9-bf16-e429f6904e80","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9d38668c-03bd-4162-9cde-a519b3c123fa"}],"recentChangeFlags":null},{"id":"8c9c641d-7a4f-4a75-abf4-0bb3f2c961d9","uri":"https://www.apartmentfinder.com","name":"Apartment Finder","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a762b5e7-c546-4215-9c65-7da18aef3f27","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8c9c641d-7a4f-4a75-abf4-0bb3f2c961d9"}],"recentChangeFlags":null},{"id":"ade90758-befc-4bb9-a513-f6a351b0be3c","uri":"https://www.apartmenthomeliving.com","name":"Apartment Homeliving","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f57d6374-5d00-4a4d-9e83-049e965cff22","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ade90758-befc-4bb9-a513-f6a351b0be3c"}],"recentChangeFlags":null},{"id":"e1cebc6e-83d2-4dfb-b4ea-d6b773e9cc38","uri":"https://www.corporatehousing.com/","name":"Corporate Housing","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aac09a98-0881-4424-b1ba-44e48e03e228","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e1cebc6e-83d2-4dfb-b4ea-d6b773e9cc38"}],"recentChangeFlags":null},{"id":"ec78ac33-2f31-4c7c-8064-2d61cdd4d7be","uri":"https://ecom.apartments.com","name":"Apartments ECOM","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"eb96406e-64e8-4ff0-bcc2-1182305c6167","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ec78ac33-2f31-4c7c-8064-2d61cdd4d7be"}],"recentChangeFlags":null},{"id":"8c2f71e4-9337-410c-8e28-2cf7f46ccdc9","uri":"https://leasing.apartments.com/","name":"Apartments Leasing","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"de3f2206-91dd-4d62-9817-ba435d0205ea","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8c2f71e4-9337-410c-8e28-2cf7f46ccdc9"}],"recentChangeFlags":null},{"id":"4760e7f4-9371-4783-8e37-e9b2657da355","uri":"https://networkadmin.prd.apartments.com/","name":"Apartments Admin","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"895f7295-aea8-4e51-b619-f2a60c25c62a","sortOrder":13},"sortOrder":13,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4760e7f4-9371-4783-8e37-e9b2657da355"}],"recentChangeFlags":null},{"id":"0ebd6106-205c-4e55-883e-39a6b404058e","uri":"https://www.westsiderentals.com/","name":"Westside Rentals","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c2ca1bd1-068a-4b0c-ad8a-1d113235c469","sortOrder":14},"sortOrder":14,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0ebd6106-205c-4e55-883e-39a6b404058e"}],"recentChangeFlags":null},{"id":"85c50cdd-9a97-40cb-a731-da1787678ef6","uri":"https://listingmanager.costar.com/","name":"Listing Manager","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4f3a4879-b3e4-4c5d-b7f0-45f979ca52b7","sortOrder":15},"sortOrder":15,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"85c50cdd-9a97-40cb-a731-da1787678ef6"}],"recentChangeFlags":null},{"id":"4356e094-dd12-4094-87bc-9de19a28f24f","uri":"https://dev-app.matterport.com/","name":"Matterport","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4d2bb838-2a86-4c8b-9b33-db300c9f431f","sortOrder":16},"sortOrder":16,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4356e094-dd12-4094-87bc-9de19a28f24f"}],"recentChangeFlags":null},{"id":"7865154b-5354-40fd-b855-36c9da081e8e","uri":"https://attachments-handler-us-east-1.prd.attachments.aws.dshrp.com/","name":"Attachment Handler","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4c77eb60-b473-43f2-805f-9b73a7fe1c5d","sortOrder":17},"sortOrder":17,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7865154b-5354-40fd-b855-36c9da081e8e"}],"recentChangeFlags":null},{"id":"892d6483-376a-44c5-9488-6fe0f629cc17","uri":"https://api.prd.bizbuysell.com/","name":"BizBuySell API","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a9146871-ca7d-4186-b77e-cc50d3cf58a3","sortOrder":18},"sortOrder":18,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"892d6483-376a-44c5-9488-6fe0f629cc17"}],"recentChangeFlags":null},{"id":"a66a4252-605b-41f3-9ac0-31afc934d12a","uri":"https://www.bizbuysell.com/","name":"BizBuySell","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"766f459c-8054-4f35-8f68-eb8dc926af0f","sortOrder":19},"sortOrder":19,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a66a4252-605b-41f3-9ac0-31afc934d12a"}],"recentChangeFlags":null},{"id":"61ef0110-e51f-4766-a676-0f40eacbc735","uri":"https://www.bizquest.com/","name":"BizQuest","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"946aa1a8-9f93-40ed-b09d-01c6c8f695e0","sortOrder":20},"sortOrder":20,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"61ef0110-e51f-4766-a676-0f40eacbc735"}],"recentChangeFlags":null},{"id":"f2567f11-3792-4ed0-bf34-e80bc5a6645c","uri":"https://www.bureauxlocaux.com/","name":"Bureaux Locaux","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"40dd0c8b-73f4-451a-9767-aaaa3f8a7df8","sortOrder":21},"sortOrder":21,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f2567f11-3792-4ed0-bf34-e80bc5a6645c"}],"recentChangeFlags":null},{"id":"9ea85956-1e74-45cd-95a7-483041970a65","uri":"https://www.businessimmo.com/","name":"Business Immo","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e0de1ed8-efbf-4d5c-8456-a6733c842bcc","sortOrder":22},"sortOrder":22,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9ea85956-1e74-45cd-95a7-483041970a65"}],"recentChangeFlags":null},{"id":"466d9ae9-bd8d-4646-919b-bc31aad90573","uri":"https://secure.costargroup.com/","name":"Central Auth","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"da99cdff-ef88-4a75-9a4f-a2dbf8cc8886","sortOrder":23},"sortOrder":23,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"466d9ae9-bd8d-4646-919b-bc31aad90573"}],"recentChangeFlags":null},{"id":"51cfeaf2-9586-4d02-b4ec-df31b754bc5d","uri":"https://www.costarpowerbrokers.com/","name":"Power Broker","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"597bcabf-08ae-4557-942d-fbacc1170b66","sortOrder":24},"sortOrder":24,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"51cfeaf2-9586-4d02-b4ec-df31b754bc5d"}],"recentChangeFlags":null},{"id":"380ab4bd-d750-4a9d-8863-5de9bc50d3b1","uri":"https://*.costarremanager.com/","name":"CoStar Real Estate Manager","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"acc4bad5-01ac-4bb6-909f-c7338d98ca3e","sortOrder":25},"sortOrder":25,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"380ab4bd-d750-4a9d-8863-5de9bc50d3b1"}],"recentChangeFlags":null},{"id":"e172b1ff-a672-47de-a1a7-29cbdaeea06d","uri":"https://product.costar.com/lender/","name":"CoStar Suite","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"91fc65e7-8f3d-4bf9-ab33-c3ba261fe6c4","sortOrder":26},"sortOrder":26,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e172b1ff-a672-47de-a1a7-29cbdaeea06d"}],"recentChangeFlags":null},{"id":"b05dd558-4e3c-48e9-9708-5b79b936a316","uri":"https://data-us-east-1.prd.dataservices.aws.dshrp.com/","name":"CoStar APIs","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7d400e54-1a31-49a2-a812-d1fe6af08c90","sortOrder":27},"sortOrder":27,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b05dd558-4e3c-48e9-9708-5b79b936a316"}],"recentChangeFlags":null},{"id":"99ac2aa8-c76f-427a-8291-8494eb09a917","uri":"https://fieldresearch-bff.costargroup.com/","name":"Field Research","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5cbd0c25-ff05-4e7d-9cbf-812f0ac20ed2","sortOrder":28},"sortOrder":28,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"99ac2aa8-c76f-427a-8291-8494eb09a917"}],"recentChangeFlags":null},{"id":"010249c5-c76f-40eb-92bf-81668898b530","uri":"https://www.findafranchise.com/","name":"Find A Franchise","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"90a81f2b-aea8-4773-9fd4-43e7c3b96c46","sortOrder":29},"sortOrder":29,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"010249c5-c76f-40eb-92bf-81668898b530"}],"recentChangeFlags":null},{"id":"07a03214-db15-4967-bb76-f012191ebd7a","uri":"https://messaging.forrent.com/","name":"For Rent Messaging","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e8f42ef9-3d4a-4f5f-ad78-9325ed78f4d8","sortOrder":30},"sortOrder":30,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"07a03214-db15-4967-bb76-f012191ebd7a"}],"recentChangeFlags":null},{"id":"52236f05-708e-4dd2-a8e7-3a16c308b959","uri":"https://www.forrent.com/","name":"For Rent","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"081dabe3-7d3f-4319-a260-b4337d421c8c","sortOrder":31},"sortOrder":31,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"52236f05-708e-4dd2-a8e7-3a16c308b959"}],"recentChangeFlags":null},{"id":"c173d765-c3b6-46dd-bae8-82d0f29a6200","uri":"https://www.forrentuniversity.com/","name":"For Rent University","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4b43ace5-6125-4fee-8765-cc3ecc9dce14","sortOrder":32},"sortOrder":32,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c173d765-c3b6-46dd-bae8-82d0f29a6200"}],"recentChangeFlags":null},{"id":"9685732b-b433-499f-8328-5ea1c73806be","uri":"https://www.citysnap.com/","name":"City Snap","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fee1bbae-3637-43f1-92a2-67f2c6620e55","sortOrder":33},"sortOrder":33,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9685732b-b433-499f-8328-5ea1c73806be"}],"recentChangeFlags":null},{"id":"fde465d2-e66f-48c9-bceb-944889f558dd","uri":"https://www.homes.com/","name":"Homes","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1be04835-7cd3-41b0-b9ff-bd11246925f0","sortOrder":34},"sortOrder":34,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fde465d2-e66f-48c9-bceb-944889f558dd"}],"recentChangeFlags":null},{"id":"21e2dcde-81f0-4087-a0cb-487b53180733","uri":"https://networkadmin.homes.com/","name":"Homes Admin","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e9c1909e-219a-4d1c-9048-4d9b8b7a513f","sortOrder":35},"sortOrder":35,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"21e2dcde-81f0-4087-a0cb-487b53180733"}],"recentChangeFlags":null},{"id":"a1153cfb-d700-4b3b-baa8-a63de10468a9","uri":"https://www.acrevalue.com/","name":"AcreValue","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ee016226-558b-41d5-97fc-adeab8690d83","sortOrder":36},"sortOrder":36,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a1153cfb-d700-4b3b-baa8-a63de10468a9"}],"recentChangeFlags":null},{"id":"23b6786b-95b8-4a5b-9302-3d93415ec167","uri":"https://www.land.com/","name":"Lands","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7241e40b-9e8d-48c7-b648-2194a169d3b6","sortOrder":37},"sortOrder":37,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"23b6786b-95b8-4a5b-9302-3d93415ec167"}],"recentChangeFlags":null},{"id":"38e82cf8-cbf4-43f6-89ee-ca9cf08f2e81","uri":"https://api.land.com/","name":"Lands API","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"55325a75-2e33-4ec6-a24b-456547fec316","sortOrder":38},"sortOrder":38,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"38e82cf8-cbf4-43f6-89ee-ca9cf08f2e81"}],"recentChangeFlags":null},{"id":"73f46d59-b936-441d-ab2e-c178de8f06ed","uri":"https://www.landandfarm.com/","name":"Land and Farm","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f26ff83b-664b-40e9-8880-18005475321e","sortOrder":39},"sortOrder":39,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"73f46d59-b936-441d-ab2e-c178de8f06ed"}],"recentChangeFlags":null},{"id":"9608ce07-443a-4bfc-a29e-a3d83044bd3f","uri":"https://www.landwatch.com/","name":"Land Watch","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3fd2de97-8902-4340-9035-1f41fff890be","sortOrder":40},"sortOrder":40,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9608ce07-443a-4bfc-a29e-a3d83044bd3f"}],"recentChangeFlags":null},{"id":"ae021bf2-0a66-4aa2-8fd9-ec6010501cc7","uri":"https://market.land.com/","name":"Marketing Hub","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"07661039-5a32-4ac1-977c-8fecac233f45","sortOrder":41},"sortOrder":41,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ae021bf2-0a66-4aa2-8fd9-ec6010501cc7"}],"recentChangeFlags":null},{"id":"819138a3-9111-4adb-886a-49ff4208528a","uri":"https://www.propertycontrolcenter.com/","name":"Property Control Center","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3afd9a62-5440-43de-9993-8bd14f08af56","sortOrder":42},"sortOrder":42,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"819138a3-9111-4adb-886a-49ff4208528a"}],"recentChangeFlags":null},{"id":"5a78c77f-9ffc-4e45-aa35-8bdb0ed8ded8","uri":"https://www.cityfeet.com","name":"City Feet","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"87bf9b96-dc6c-4949-bd06-f085e8ae4160","sortOrder":43},"sortOrder":43,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5a78c77f-9ffc-4e45-aa35-8bdb0ed8ded8"}],"recentChangeFlags":null},{"id":"12d3476f-364e-444f-9faa-52891095fd40","uri":"https://dev-buy.matterport.com/","name":"Buy Matterport","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"86f0995e-0242-4595-8ea3-9e5aca797296","sortOrder":44},"sortOrder":44,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"12d3476f-364e-444f-9faa-52891095fd40"}],"recentChangeFlags":null},{"id":"1acf8c9b-df61-452a-8c3f-3852b96b4e07","uri":"https://cs.matterport.com/","name":"Support Matterport","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6e74d3a3-cc55-4607-8587-cd1344233924","sortOrder":46},"sortOrder":46,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1acf8c9b-df61-452a-8c3f-3852b96b4e07"}],"recentChangeFlags":null},{"id":"092908f4-1260-49ff-8bce-a2f8dd9a58de","uri":"https://admin.offcampuspartners.com/","name":"Off Campus Partners","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"38a9bfa6-a9b5-40ff-ada1-af92771a7f81","sortOrder":47},"sortOrder":47,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"092908f4-1260-49ff-8bce-a2f8dd9a58de"}],"recentChangeFlags":null},{"id":"bbe01bec-7373-44d7-a158-cd8717a75793","uri":"https://product.offcampuspartners.com/","name":"Off Campus Partners Product","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"28ab2c22-2468-4470-bdd4-7e6fbe81d473","sortOrder":48},"sortOrder":48,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"bbe01bec-7373-44d7-a158-cd8717a75793"}],"recentChangeFlags":null},{"id":"83c1ec99-3cfe-4cba-8cf2-4b89e39bb00d","uri":"https://www.ampmhotels.com/","name":"AM:PM Hotels","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"18a0015e-12be-445a-a68f-ae3b57bfee0b","sortOrder":50},"sortOrder":50,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"83c1ec99-3cfe-4cba-8cf2-4b89e39bb00d"}],"recentChangeFlags":null},{"id":"585483a0-ba7e-48c5-a987-8f05a7c26589","uri":"https://auctiondash.ten-x.com/","name":"Ten-X Auctioneer","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a7af3e6f-adcb-4c5c-9301-f21a711be4af","sortOrder":51},"sortOrder":51,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"585483a0-ba7e-48c5-a987-8f05a7c26589"}],"recentChangeFlags":null},{"id":"daf1818a-f78a-4fb9-a8f6-aea4bdc1a5ed","uri":"https://www.ten-x.com/","name":"Ten-X","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f2123b55-c739-4811-8e76-d1b4d95b1882","sortOrder":52},"sortOrder":52,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"daf1818a-f78a-4fb9-a8f6-aea4bdc1a5ed"}],"recentChangeFlags":null},{"id":"613d0eb7-65f9-4282-804c-7b9934e156fa","uri":"https://www.thomas-daily.de/","name":"Thomas Daily Marketing","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ba837b54-1d22-48a1-9517-d0b7f2671f21","sortOrder":53},"sortOrder":53,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"613d0eb7-65f9-4282-804c-7b9934e156fa"}],"recentChangeFlags":null},{"id":"16007e32-7945-4450-a0c0-3476edd30c6c","uri":"https://web.thomas-daily.de/","name":"Thomas Daily Web","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f3768d17-aace-4ca1-b3f2-3475ab14dd15","sortOrder":54},"sortOrder":54,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"16007e32-7945-4450-a0c0-3476edd30c6c"}],"recentChangeFlags":null},{"id":"b9e364b0-25da-490e-a0b7-093fd99fbf1d","uri":"https://visuallease.com/","name":"Visual Lease","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"69010090-b38b-4c74-954d-65533322de64","sortOrder":55},"sortOrder":55,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b9e364b0-25da-490e-a0b7-093fd99fbf1d"}],"recentChangeFlags":null},{"id":"20e7473b-abbd-470c-bf53-715c7ec6837b","uri":"https://webhook.visuallease.com/","name":"Visual Lease Webhook","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4f322fbf-4689-40c6-9269-9e022cb15aa6","sortOrder":56},"sortOrder":56,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"20e7473b-abbd-470c-bf53-715c7ec6837b"}],"recentChangeFlags":null},{"id":"913470cb-b75c-4d6a-8090-47624bef9cde","uri":"https://we.costar.com/","name":"Web Enterprise","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1de500da-1092-4096-a2c6-3c1a0d39a18b","sortOrder":57},"sortOrder":57,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"913470cb-b75c-4d6a-8090-47624bef9cde"}],"recentChangeFlags":null},{"id":"000c78d3-fb97-4954-ab70-693ff18b6b12","uri":"https://discover.matterport.com/","name":"Discover Matterport","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"de5f21ff-cb6f-4beb-aa8a-792f30251ab4","sortOrder":58},"sortOrder":58,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"000c78d3-fb97-4954-ab70-693ff18b6b12"}],"recentChangeFlags":null},{"id":"7205500e-ab7f-4b4c-a9d6-18bf85f24ea4","uri":"https://qa3-captureservices.matterport.com/","name":"Capture Services QA","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"73aec3c6-2343-4137-bfa0-b60a671601de","sortOrder":58},"sortOrder":58,"tags":null,"recentChangeFlags":null},{"id":"29c613e9-0911-428e-b701-2543f4498405","uri":"https://captureservices.matterport.com","name":"Capture Services","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"6ff7986a-0939-48f7-be50-18ce293b24c7","sortOrder":59},"sortOrder":59,"tags":null,"recentChangeFlags":null},{"id":"582c5f8e-5e47-4270-bdc4-312a98d489b6","uri":"https://dev-api.matterport.com/graphiql","name":"API Matterport","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"7dc9c77f-ca04-440e-9e40-6b32e5822282","sortOrder":60},"sortOrder":60,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"582c5f8e-5e47-4270-bdc4-312a98d489b6"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"4e128913-b161-4b95-883e-14592593943a","name":"Out-of-Scope","targets":[{"id":"5b4e3988-ebe0-44ea-9627-0eff2b850457","uri":"https://www.onthemarket.com/","name":"OnTheMarket","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"82e7a290-bdbf-4e07-876f-e1222a77d26a","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"5b4e3988-ebe0-44ea-9627-0eff2b850457"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"7f8b389e-3d24-4f17-a4fc-ec2ef1697987","code":"costar-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"0b5e8c17-e8c8-45d7-92c1-f433e47e0400","startsAt":"2026-05-19T00:00:00Z"},"vrtScopeRules":[{"id":"6a4993c2-fdcb-45d3-8cc4-c9204f2ecc14","notes":"","targets":[],"vrtIds":{"categories":[{"id":"sensitive_data_exposure.exif_geolocation_data_not_stripped_from_uploaded_images","version":"1.18"}]},"allTargets":true,"targetGroups":[],"exclusionType":"out_of_scope"},{"id":"7328a9bb-5056-4f26-99a6-6e5b5d5755db","notes":"","targets":[],"vrtIds":{"categories":[{"id":"server_side_injection.content_spoofing.email_html_injection","version":"1.18"}]},"allTargets":true,"targetGroups":[],"exclusionType":"out_of_scope"}],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Real Estate","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/ae3e/c3e6/3aff53bf/39655e2fcaebfa25ef4dcee13c60027a_costar_us_logo.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2026-05-19T00:00:00.273Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/costar-vdp-pro","changelogs":"/engagements/costar-vdp-pro/changelog","submissions":null,"announcements":"/engagements/costar-vdp-pro/announcements","hallOfFame":"/engagements/costar-vdp-pro/hall_of_fames","crowdstream":"/engagements/costar-vdp-pro/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/costar-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=costar-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/costar-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/costar-vdp-pro/changelog","publishedAt":"2026-07-13T15:34:42.622Z","engagementChangelogUrl":"/engagements/costar-vdp-pro/changelog/b9f52550-a5a5-41d6-979e-89a663bd9ce7","createUserFeedbacksUrl":"/engagements/costar-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/costar-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[{"id":"6a4993c2-fdcb-45d3-8cc4-c9204f2ecc14","vrt_ids":{"categories":[{"id":"sensitive_data_exposure.exif_geolocation_data_not_stripped_from_uploaded_images","lineage":"Sensitive Data Exposure \u003e EXIF Geolocation Data Not Stripped From Uploaded Images","version":"1.18"}]},"targets":[],"target_groups":[],"exclusion_type":"out_of_scope","notes":"","all_targets":true},{"id":"7328a9bb-5056-4f26-99a6-6e5b5d5755db","vrt_ids":{"categories":[{"id":"server_side_injection.content_spoofing.email_html_injection","lineage":"Server-Side Injection \u003e Content Spoofing \u003e Email HTML Injection","version":"1.18"}]},"targets":[],"target_groups":[],"exclusion_type":"out_of_scope","notes":"","all_targets":true}]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}