{"id":"49d03813-c82a-496c-ad34-2305039031ac","engagementId":"306f2537-08e9-486a-950a-de50963a52c4","data":{"brief":{"id":"33b5e7ba-f841-4ede-a4fb-287ba2b9f4dd","name":"The NatWest Group Vulnerability Disclosure Program","tagline":"“We champion potential, helping people, families and businesses to thrive”","description":"\u003cp\u003eThank you for participating in the NWG’s Responsible Disclosure Program. The responsible disclosure of security vulnerabilities helps us protect the security and privacy of all our customers. \u003cbr\u003e\nOur fundamental purpose is to keep our customers safe and secure. We recognise the important role that security researchers and our customers also play. \u003cbr\u003e\n\u003cstrong\u003eThis program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eNo technology is perfect and at NatWest we believe that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for your submissions, and we look forward to working together. \u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eNo monetary reward for findings will be provided on this program.\u003c/em\u003e\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"b3d6ff0b-119e-4f5b-9c38-ee13f125fc52","targetsOverview":"\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eTargets on this program include those from our production environments, hence all testing needs to be performed in a production safe manner and all the following instructions should be strictly adhered to.\u003cbr\u003e\n\u003cstrong\u003eNatWest uses third-party providers and services – including a number hosted on subdomains across our brands that will be considered Out of Scope for this program.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eIf you have any questions around something being production safe or not, reach out to support@bugcrowd.com with any questions:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eIf you discover any credentials during recon and testing, DO NOT use them for additional testing\u003c/li\u003e\n\u003cli\u003eDO NOT pursue post-exploitation or pivot from the vulnerable target into other parts of the network\u003c/li\u003e\n\u003cli\u003eWe will NOT accept Vulnerabilities dependent upon social engineering techniques (e.g. shoulder attack, stealing devices, phishing, fraud, stolen credentials)\u003c/li\u003e\n\u003cli\u003eOutdated web browsers: vulnerabilities contingent upon outdated or unpatched browsers will NOT be accepted\u003c/li\u003e\n\u003cli\u003eVulnerabilities which require a jailbroken mobile device will NOT be accepted\u003c/li\u003e\n\u003cli\u003eRecursive DNS enumeration should be minimised\u003c/li\u003e\n\u003cli\u003eNO Self-XSS (User defined payload)\u003c/li\u003e\n\u003cli\u003eAny scanning or brute force attempts on Submission Forms is considered Out-Of-Scope and should not be attempted\u003c/li\u003e\n\u003cli\u003eFor any enumeration activities, scanners should be limited to a maximum of 5 requests/second.\u003c/li\u003e\n\u003cli\u003eNO Denial of service: DOS/DDOS\u003c/li\u003e\n\u003cli\u003eCredential Stuffing/Password Spraying attacks is prohibited\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eNWG will NOT accept generic vulnerability scan results, as these are likely to be duplicated.\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eThe use of personal credentials for testing purposes is strictly prohibited and may trigger or result in investigations by the NWG fraud team and/or law enforcement. Please do not, under any circumstances, use credentials including your own personal account for testing purposes. This is to protect you and any/all of your own banking accounts/details. This program is set up as an unauthenticated program. If you have any questions regarding this matter, please contact support@bugcrowd.com\u003c/p\u003e\n\n\u003ch2\u003eTesting headers\u003c/h2\u003e\n\n\u003cp\u003ePlease include the following headers in \u003cstrong\u003eall\u003c/strong\u003e server requests. This will not affect the responses to your activity, but allows Natwest to identify Researcher testing activity and avoid IP blocking, so not to disrupt your testing efforts.\u003cbr\u003e\n\u003cstrong\u003eRequired\u2028\u003c/strong\u003e\u003cbr\u003e\n\u003ccode\u003eX-Request-Purpose: Research\u003c/code\u003e\u003cbr\u003e\n\u003cstrong\u003eOptional\u003c/strong\u003e\u003cbr\u003e\n\u003ccode\u003eX-Bugcrowd-Ninja: [username]\u003c/code\u003e\u003c/p\u003e\n\n\u003ch3\u003eN-Day Policy:\u003c/h3\u003e\n\n\u003cp\u003eWhen N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by\u003cbr\u003e\ne.g: N-day released on 01/01/2024, we would consider it in-scope on 01/15/2024\u003c/p\u003e\n\n\u003ch3\u003eThird party services\u003c/h3\u003e\n\n\u003cp\u003eNatWest uses third-party providers and services – including a number hosted on subdomains across our brands that will be considered Out of Scope for this program. \u003cbr\u003e\nWe cannot authorise security testing against systems that do not belong to us, however we would encourage you to report any issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of NatWest misconfiguration or insecure usage of that service, we would appreciate it greatly if you could share your finding.\u003c/p\u003e\n\n\u003cp\u003eNatWest utilise a number of cloud service providers, for the testing of these please follow their own testing guidelines. For example:\u003cbr\u003e\nAWS: \u003ca href=\"https://aws.amazon.com/security/penetration-testing/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://aws.amazon.com/security/penetration-testing/\u003c/a\u003e\u003cbr\u003e\nAzure: \u003ca href=\"https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement\u003c/a\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"47b97a62-2a56-4c7e-84c7-0a2e4845ed03","name":"NatWest Group","targets":[{"id":"d19b6a3c-86fa-46f9-9c49-33f800276149","uri":"https://*.coutts.com","name":"*.coutts.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"d2626a5d-f885-4f93-9027-5699f2b8cd14","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"2b891e3e-4d4a-426e-bd87-e75b2ac03bab","uri":"https://*.natwest.com","name":"*.natwest.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"11eeb9fa-4e9f-460b-b989-02b8cc5d8fbb","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"df830e92-e06b-440f-b218-e1529b4780cf","uri":"https://*.natwest.co.uk","name":"*.natwest.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ca85f3ba-7d0f-459c-a56a-d3c923a7c29a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"2f60b0e0-ff2d-403a-bd1b-59368e3d17c1","uri":"https://*.natwestgroup.com","name":"*.natwestgroup.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"56efe04f-342e-4bb1-b8a9-a02f75355451","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d4f36738-d2f9-4773-b5d6-2d4041129325","uri":"https://*.rbs.co.uk","name":"*.rbs.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c901e0ba-faac-47d3-8c0a-cccfba2d33ec","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"3a304965-1eb1-4182-9b0a-b7b10bbdfb2e","uri":"https://*.rbs.com","name":"*.rbs.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1b128ef0-817b-41d1-ae0e-c41e58b59c5d","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"d936b4b9-9a9e-44ed-a147-61f556816b2c","uri":"https://*.ulsterbank.co.uk","name":"*.ulsterbank.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"20bfc3b3-db7e-46bd-b61c-b63f467e5694","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"fb8801bb-dbd1-4afe-9fa8-60ec2d075c73","uri":"https://*.ulsterbank.ie","name":"*.ulsterbank.ie","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7b6fffd7-467a-44d5-96a1-6cc3271d2862","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"252a1901-4e07-46b4-91f2-e1472c496bee","uri":"https://*.ulsterbank.com","name":"*.ulsterbank.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9037ff6d-1e2a-4439-87df-a43782ddd60e","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7f408227-4d92-4f02-ac03-25b91af5e347","uri":"https://*.natwestinternational.com","name":"*.natwestinternational.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"0803fe77-031d-4a58-bcef-0563b1df4b2b","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"4cfa9152-62f3-4706-a426-66eaf0f5d739","uri":"https://*.iombank.com","name":"*.iombank.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5dd48c3c-479f-4d43-85c2-96e10de99c1a","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e78bf231-745f-44da-8d7c-41060d307269","uri":"https://*.rbsinternational.com","name":"*.rbsinternational.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"2a3df42e-16c6-4628-bfa5-839759379236","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"0e1903c9-c8d6-4491-b125-37951a66436d","uri":"https://*.rbsmentor.co.uk","name":"*.rbsmentor.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ff135c91-9d26-424a-a42d-0060c9be54de","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"01b3d621-c0b7-4a3d-b1c7-59229f39d86a","uri":"https://*.rbspeople.com","name":"*.rbspeople.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"04d2106f-b59d-49a0-80c9-c02969009691","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"ffc2cfb8-c7e4-4a08-afe9-75625a094e26","uri":"https://*.nwgpeople.com","name":"*.nwgpeople.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"04cca789-a87b-4131-9137-5ab061637d06","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"405ae2c4-616e-4e61-a168-ccfd983c2c27","uri":"https://*.natwestmentor.co.uk","name":"*.natwestmentor.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"47b287d0-9645-498d-ab1f-487a33a05982","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"5dc98375-ab90-42ed-86b2-f33ee26029e0","uri":"https://*.natwestoffshore.com","name":"*.natwestoffshore.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fa9b5b08-0041-433c-9ba8-f7f7e29f3b21","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7f7402f9-9df0-479f-bf54-5a138bf4695d","uri":"https://*.couttscrowndependencies.com","name":"*.couttscrowndependencies.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8f7e9098-1083-4eb2-b88f-6040ffdd0c02","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"0d74ac58-69bc-4d23-901c-43704a40b72c","uri":"https://*.mymoneysense.com","name":"*.mymoneysense.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"12fb8b17-e24e-4d52-bd91-b93f3d72b7e6","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"a0f412c8-d045-4c28-be1e-bcc06e550a30","uri":"https://*.holtsmilitarybank.co.uk","name":"*.holtsmilitarybank.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"fd6c0ffa-5aa7-4580-b9b1-f9e692d54af7","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"7c9f0194-99ec-49e5-ab8e-30b62aad96c9","uri":"https://*.natwestgrouppeople.com","name":"*.natwestgrouppeople.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"09a447c0-5cfe-484a-9d90-8133839e0dce","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e4af948e-f3ab-45f8-9b87-ae52e533850f","uri":"https://*.lombard.co.uk","name":"*.lombard.co.uk","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f7b8b52e-f600-496c-8aa6-6009ef90e893","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"b5dacd04-8d32-4f1f-9701-062d3f245274","uri":"https://*.lombard.com","name":"*.lombard.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ac6fc0e0-9acb-4ee9-87f5-ccbb46c9b3ed","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e1df8922-0ca3-4a65-85a4-d5fcd535b222","uri":"https://*.managedtest.com","name":"*.managedtest.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"92984b29-e1d3-4ebc-a05b-04b5aac995d3","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"73df24a3-21f6-4039-86fb-7b905ff4b7cd","uri":"","name":"Any other asset that appears to belong to NatWest Group.","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"8db21435-77c9-491a-9e92-7037529a0547","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eYou are testing on production. Behaviour that compromises the stability and integrity of the site is out of scope. For example, do not target other user\u0026#39;s data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target\u0026#39;s ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it.\u003c/p\u003e\n\n\u003cp\u003eWe want to hear from you if you discover a vulnerability on any of the following domains/subdomains:\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"306f2537-08e9-486a-950a-de50963a52c4","code":"natwest-vdp","state":"in_progress","endsAt":null,"bountyId":"52641c54-69ea-4594-9819-8bc304ef14a4","startsAt":"2023-04-04T10:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Banking","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/9ce9/b338/f897b8f9/94f0f5779edd780aea6d9f9c3315c41e_natwest-logo_5f3491394934a-768x822.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2023-04-04T10:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/natwest-vdp","changelogs":"/engagements/natwest-vdp/changelog","submissions":null,"announcements":"/engagements/natwest-vdp/announcements","hallOfFame":"/engagements/natwest-vdp/hall_of_fames","crowdstream":"/engagements/natwest-vdp/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/natwest-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=natwest-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/natwest-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/natwest-vdp/changelog","publishedAt":"2024-10-28T10:04:46.321Z","engagementChangelogUrl":"/engagements/natwest-vdp/changelog/49d03813-c82a-496c-ad34-2305039031ac","createUserFeedbacksUrl":"/engagements/natwest-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/natwest-vdp/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}