Supported languages:
Bounty rules:
The Bug Bounty program only accepts and pays for reports on vulnerabilities previously unknown to the VK team.
The types of vulnerabilities eligible for bounties are listed in the "Rewards" table at the end of the rules for the Bug Bounty program rules.
The bounty amounts shown in the description are for reference only.
The applicability and amount of a bounty may depend on the severity of the problem, novelty, likelihood of use, environment, and/or other factors.
The VK security team makes a bounty decision for each message individually.
Any vulnerabilities not listed in the "Bounty amount" table are paid for at the discretion of the program owner.
Scope of the Bug Bounty program:
Mobile apps:
Domains:
mail.ru (without subdomains), e.mail.ru, touch.mail.ru, m.mail.ru, tel.mail.ru, light.mail.ru, octavius.mail.ru, smtp.mail.ru, mxs.mail.ru, pop.mail.ru, imap.mail.ru, cloud.mail.ru, disk-o.cloud, calendar.mail.ru, todo.mail.ru, calls.mail.ru, auth.mail.ru, o2.mail.ru, account.mail.ru, swa.mail.ru, id.mail.ru, contacts.mail.ru, notes.mail.ru, doc.mail.ru, board.vk.com except for delegated and externally hosted domains and branded partner services.
Out of scope domains:
love.mail.ru
Important:
Errors common to the application or server for Mail.Ru and MyMail are usually accepted as a single error.
Public 0-day/1-day vulnerabilities may be considered duplicates for several weeks after a vulnerability is published if our team knows about the vulnerability from open sources and we are working to eliminate or fix it.
Bug reports submitted by current or former employees (up to one year from the end of employment) of the VK Group are accepted without payment.
When testing RCE, SQLi, LFI, LFR, or SSTI, only the use of the MINIMUM possible POC (sleep, reading /etc/passwd, curl) is allowed. If you want to test the possibility of privilege elevation on a server, please create a report and write that you want to elevate privileges.
Publishing or disclosing bug report and/or any details associated with VK products without approval from VK's information security team is prohibited. We reserve the right to refuse any request for public disclosure of the report.
Vulnerability testing should only be done on your own accounts.
Limitations on the scope of the Bug Bounty program:
When testing, it is recommended to limit scanning tools to 10 requests per second.
We do not accept or review:
- Bug reports from vulnerability scanners and other automated tools;
- Disclosure of information that is not confidential, for example, the version of a product;
- Disclosure of information about a user that is public, for example, a user's nickname;
- Bug reports based on the version of a product/protocol (e.g. TLS version) without demonstrating the actual presence of a vulnerability;
- Bug reports about a missing security mechanism/current best practice (e.g. missing - CSRF token, framing/clickjacking protection) without demonstrating an actual impact on the security of users or the system;
- Messages about published and unpublished SPF and DMARC policies;
- Cross-site request forgery leading to logout (logout CSRF);
- Vulnerabilities in partner products or services, unless Mail.Ru or VK.com users/accounts are directly affected;
- Security of rooted, jailbroken, or otherwise modified devices and applications;
- Ability to reverse engineer an application, or the lack of binary protection;
- Open redirection vulnerabilities are accepted only if a security impact is identified, such as the possibility of stealing an authorization token;
- Injecting unformatted text, audio, images, or video into a server response outside of the user interface (for example, into JSON data or an error message), unless doing so replaces the user interface, changes the behavior of the user interface, or results in other negative consequences;
- Same site scripting, reflected downloads, and similar attacks with questionable impact;
- CSP-related bug reports for domains without CSPs and domain policies with unsafe-eval and/or unsafe-inline;
- IDN homograph attacks;
- XSPA (scanning the IP addresses/ports of external networks);
- Excel CSV formula injection;
- Scripting in PDF documents;
- Attacks that require full access to a local account, browser profile or physical access to the device;
- Attacks based on scenarios where a vulnerability in a third-party site or application is required as a prerequisite and is not demonstrated;
- Theoretical attacks without proof of feasibility;
- Denial of service (DoS) vulnerabilities, for example - sending a large volume of requests or data (flooding);
- Ability to send a large number of messages;
- Ability to send spam or a malware file (for example, registration or password recovery spam);
- Disclosure of information through external links not controlled by Mail.Ru or VK.com (for example, Google dorking of private protected areas of robots.txt);
- Disclosure of unused or properly restricted JS API keys (for example, an API key for an external map service);
- Ability to perform an action not available through the user interface and without identified security risks;
- Vulnerabilities associated with the use of phishing and other social engineering techniques;
- Disclosure of /metrics, /status, htaccess or similar without a demonstrated information security threat (for example, disclosure of private API methods, tokens);
- Blind SSRF vulnerabilities without demonstrating a threat to the service's information security in the report;
- EXIF metadata in images;
- SSRF vulnerabilities that involve sending requests via rentgen*.smailru.net, snipster.*.go.mail.ru, mpr*.m.smailru.net, rs-proxy*.i.smailru.net or other proxies specifically designed to protect against SSRF;
- Vulnerabilities that disclose only user accounts but not passwords or other personal data.
We consider bug reports as informational if:
- The vulnerability discloses information about hacked accounts of external users for Mail.Ru or VK.com services;
Rewards:
| Vulnerability | Bounty |
|---|
| Remote code execution (RCE) | 3 600 000 ₽ |
| Server-side Injections (SQLi or an alternative) | 2 400 000 ₽ |
| Read local file content (LFR, RFI, XXE) without restrictions (jail/chroot/other file type restrictions) | 2 400 000 ₽ |
| RCE in the Dev infrastructure / isolated or virtualized process | 600 000 ₽ |
| Read local file content (LFR, RFI, XXE) in the Dev infrastructure / isolated or virtualized process | 150 000 ₽ |
| Non-blind SSRF (with the ability to read the response text), except for dedicated proxies | 800 000 ₽ |
| Blind SSRF, except for dedicated proxies | 150 000 ₽ |
| Server-side vulnerability involving disclosure (e.g. memory leaks / IDORs) of critical or highly sensitive application data | 2 400 000 ₽ |
| Server-side vulnerability involving disclosure (e.g. memory leaks / IDORs) of protected personal data or sensitive client information | 1 200 000 ₽ |
| Server-side vulnerability involving disclosure (e.g. memory leaks / IDORs) of sensitive application* or infrastructure data / organizational role privilege escalation | 300 000 ₽ |
| Admin/support authentication bypass | 600 000 ₽ |
| Blind XSS in the admin/support interface | 300 000 ₽ |
| XSS when reading email through the message content (excluding AMP) | 120 000 ₽ |
| Cross Site Scripting (XSS)** | 60 000 ₽ |
| Cross-Site Request Forgery (СSRF) | 9 000 ‑ 60 000 ₽ |
| Compromising a local account of a mobile application or gaining full access to the data | 60 000 ₽ |
| SDC*** bypass techniques for critical projects | 90 000 ₽ |
*Detailed error output, local installation path, phpinfo() output, performance counters, etc. are not considered confidential; such messages are usually accepted without payment of a bounty. Messages about disclosure of software versions are not accepted.
**Self-XSS, XSS specific to non-common browsers (e.g. IE), blocked CSPs and other vectors without proven script execution are generally accepted without reward. Subdomain takeovers are considered under the same severity/conditions as cross-site request forgery (CSRF).
***SDC reports are accepted for SDC-aware domains with critical data (e|m|tel|touch|light|cloud|calendar|biz).mail.ru. SDC circumvention is direct or indirect (via SDC-aware domain) access to product APIs of the projects without a valid sdc/sdcs cookie, without access to ssdc cookie auth.mail.ru or valid user credentials. Web Based SDC attacks via mobile applications, for example, are not considered.