{"id":"9536048e-cb62-4794-8565-c80d153bdc1a","engagementId":"716b1c6e-ef12-40f5-b806-6b277244801e","data":{"brief":{"id":"ad6effd6-9523-4819-ace3-9efa1feb42bd","name":"SmartThings Vulnerability Disclosure","tagline":"Add a little smartness to your things.","description":"\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSmartThings lets you easily monitor, control, and secure your home from anywhere in the world.\u003c/em\u003e\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the prioritization/rating of findings.\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003eAny domain/property of SmartThings not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/p\u003e\n\n\u003ch1\u003eTarget Information\u003c/h1\u003e\n\n\u003ch3\u003eAccess\u003c/h3\u003e\n\n\u003cp\u003eResearchers are encouraged to self provision accounts and/or use any devices they currently own for testing. When registering, for identification purposes, please use your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch3\u003eTarget Features\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eConnect wirelessly with a wide range of smart devices and make them work together.\u003c/li\u003e\n\u003cli\u003eMonitor and control connected devices in your home using a single SmartThings app for iPhone or Android.\u003c/li\u003e\n\u003cli\u003eReceive alerts from connected devices when there’s activity in your home.\u003c/li\u003e\n\u003cli\u003eAutomate connected devices in your home and set them to turn on or off when doors are opened, as people come and go, and much more.\u003c/li\u003e\n\u003cli\u003eManage connected devices in your home with SmartThings Routines for Good Morning, Goodbye, Good Night, and more.\u003c/li\u003e\n\u003cli\u003eControl connected devices in your home with voice commands using SmartThings and Amazon Alexa or Google Home.\u003c/li\u003e\n\u003cli\u003eRequires an internet-connected Wi-Fi router with an available Ethernet port, SmartThings hub with connecting devices, plus the free SmartThings app for Android (4.1 or later) or iPhone (iOS 9.0 or later).\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eMobile Downloads:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cem\u003eAndroid:\u003c/em\u003e \u003ca href=\"https://play.google.com/store/apps/details?id=com.smartthings.android\u0026amp;hl=en\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHere\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cem\u003eiOS:\u003c/em\u003e \u003ca href=\"https://itunes.apple.com/us/app/smartthings-mobile/id590800740?mt=8\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHere\u003c/a\u003e\n​\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eWeb Interface:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://my.smartthings.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://my.smartthings.com/\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eREST APIs:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003ehttps://*.api.smartthings.com/\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eDocumentation:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://developer.smartthings.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developer.smartthings.com/\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003eIn-Scope\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll OWASP Top 10 issues pertaining to web and mobile applications\u003c/li\u003e\n\u003cli\u003ePrimarily: \n\n\u003cul\u003e\n\u003cli\u003eNon-Self XSS (Self-XSS is out of scope)\u003c/li\u003e\n\u003cli\u003eAll Injection flaws\u003c/li\u003e\n\u003cli\u003eAuthentication and authorization flaws\u003c/li\u003e\n\u003cli\u003eRemote exploitation of the hub including code execution bugs, overflows, command injection, gaining console/root access etc. (Weakness and security issues in ZigBee/wireless protocol itself is out-of-scope.)\u003c/li\u003e\n\u003cli\u003eSensitive information leakage - oAuth tokens, PII, secrets\u003c/li\u003e\n\u003cli\u003eRemote or local bugs exploiting the tester’s own environment (Hub, Mobile App, Sensors and communication to/from these devices) that would allow exploitation of OTHER customer’s data or environment\u003c/li\u003e\n\u003cli\u003eAll Supporting SmartThings REST APIs (*.api.smartthings.com) used by the mobile apps\u003c/li\u003e\n\u003cli\u003eMalicious File Uploads with an exploit PoC\u003c/li\u003e\n\u003cli\u003eThird-party libraries used by SmartThings\n​\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003eOut-of-Scope\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eTLS related configuration flaws\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration\u003c/li\u003e\n\u003cli\u003eIssues related to password complexity\u003c/li\u003e\n\u003cli\u003eDoS/DDoS. Do not flood the cloud API servers with large payloads.\u003c/li\u003e\n\u003cli\u003eClickjacking\u003c/li\u003e\n\u003cli\u003eoAuth expiration, scope\u003c/li\u003e\n\u003cli\u003eAPI Rate Limitations\u003c/li\u003e\n\u003cli\u003eLow or informational risk findings\u003c/li\u003e\n\u003cli\u003ePassword policies (strength, lockout, expiration etc.)\u003c/li\u003e\n\u003cli\u003eLeakage of non-secret data like unique identifiers via GET requests is out of scope. Secret data like passwords, access tokens are in scope\u003c/li\u003e\n\u003cli\u003eVulnerabilities that rely on the ZigBee protocol.  Security conscious users should consider upgrading to ZWave or Matter devices.\u003c/li\u003e\n\u003cli\u003eSmartThings relies on hardware manufactures to build devices upon which we deploy our platform and software.  As such, hardware flaws, exploits, and vulnerabilities are out of scope of this program.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eDISCLAIMER\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll the vulnerabilities should be reported with a non-malicious exploit/Proof of Concept to determine the impact of the issue. While doing so, please limit the data exposure to a maximum of 5 accounts/queries as applicable.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":null,"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"692672e9-6cd3-473b-b4f0-ca3e4fcf9bcd","name":"In scope","targets":[{"id":"b22880c0-3017-4409-a7ae-c76f5c839850","uri":null,"name":"SmartThings Hub","category":"iot","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3359b798-e69d-43b6-a0a9-5e6e1bf5f8c7","sortOrder":0},"sortOrder":0,"tags":[{"id":"4cb84232-a78c-4fc6-b51e-cbe67d4ee5f1","name":"IoT","targetId":"b22880c0-3017-4409-a7ae-c76f5c839850"}],"recentChangeFlags":null},{"id":"1108f9bd-61b0-4d85-a803-815de35dc7bc","uri":"https://apps.apple.com/us/app/smartthings/id1222822904","name":"SmartThings Mobile Application for iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"21bd5c01-8995-4b75-a6b5-27755798d555","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"1108f9bd-61b0-4d85-a803-815de35dc7bc"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"1108f9bd-61b0-4d85-a803-815de35dc7bc"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"1108f9bd-61b0-4d85-a803-815de35dc7bc"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"1108f9bd-61b0-4d85-a803-815de35dc7bc"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"1108f9bd-61b0-4d85-a803-815de35dc7bc"}],"recentChangeFlags":null},{"id":"c04880b8-57c5-4db0-81b4-6e87568145f2","uri":"https://play.google.com/store/apps/details?id=com.samsung.android.oneconnect","name":"SmartThings Mobile Application for Android","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f91257e2-8a2e-4c6d-aa32-643573b9ede0","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"c04880b8-57c5-4db0-81b4-6e87568145f2"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"c04880b8-57c5-4db0-81b4-6e87568145f2"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"c04880b8-57c5-4db0-81b4-6e87568145f2"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"c04880b8-57c5-4db0-81b4-6e87568145f2"}],"recentChangeFlags":null},{"id":"0dfdba9e-2a0d-4fd0-976e-4e3c70bd4e4d","uri":"https://smartthings.developer.samsung.com/docs/api-ref/st-api.html","name":"SmartThings Rest APIs","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1653d0da-18af-4dee-a559-d1e97f3f4aa9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0dfdba9e-2a0d-4fd0-976e-4e3c70bd4e4d"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"0dfdba9e-2a0d-4fd0-976e-4e3c70bd4e4d"}],"recentChangeFlags":null},{"id":"e5ba023b-9b6f-404f-82c4-84dded149eb2","uri":null,"name":"SmartThings Graph Console","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aa22700c-6999-40cf-a3b9-e5e7a6a626fc","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e5ba023b-9b6f-404f-82c4-84dded149eb2"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"716b1c6e-ef12-40f5-b806-6b277244801e","code":"smartthings","state":"in_progress","endsAt":null,"bountyId":"8d60c12f-cd7a-4b12-afab-201345f93189","startsAt":"2018-02-22T16:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/93ec/ae66/6158f5ed/b9932b0290dbf8d679b771de53e4edec_SmartThings_logo-07.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-02-22T16:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/smartthings","changelogs":"/engagements/smartthings/changelog","submissions":null,"announcements":"/engagements/smartthings/announcements","hallOfFame":"/engagements/smartthings/hall_of_fames","crowdstream":"/engagements/smartthings/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/smartthings/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=smartthings\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/smartthings/engagement_subscribers","engagementChangelogsUrl":"/engagements/smartthings/changelog","publishedAt":"2022-02-24T15:42:57.282Z","engagementChangelogUrl":"/engagements/smartthings/changelog/9536048e-cb62-4794-8565-c80d153bdc1a","createUserFeedbacksUrl":"/engagements/smartthings/feedbacks","engagementCrowdstreamUrl":"/engagements/smartthings/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}