Network Infrastructure Testing

vrt

Configuration Weakness > Exposed Management Interfaces > Unauthenticated Access

Priority

P3

Description

Step To Find Unauthenticated Access to Management Interfaces:

Step 1: Identify the IP range or hostname associated with the target network infrastructure.

Step 2: Scan the target IP range or hostname using a network scanning tool (e.g., Nmap) to identify open ports.

Step 3: Identify common management ports such as 22 (SSH), 23 (Telnet), 80 (HTTP), 443 (HTTPS), or other proprietary management ports.

Step 4: Attempt to access the identified management interfaces without providing any authentication credentials.

Step 5: Document any successful access to unauthenticated management interfaces and provide details about the exposed functionality.

Hacker Username

@SecureNet

Program Rules
Maintaining the security, privacy, and integrity of our products is a priority at Ably. Therefore, Ably appreciates the work of researchers in order to improve our security and/or privacy posture. We are committed to creating a safe and transparent environment to report vulnerabilities.

Out of scope vulnerabilities

Reports regarding username enumeration
Bugs requiring exceedingly unlikely user interaction
Reports of software usage disclosure or software version disclosure
Information disclosure about internal systems that does not represent a specific security vulnerability of confidentiality, integrity or availability
Reporting vulnerabilities that are deemed as accepted risks
Bugs that don’t affect the latest version of modern browsers, or browser extensions
Attacks requiring MITM or physical access to a user's device
Previously known vulnerable libraries without a working proof of concept (PoC)
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Sender Policy Framework (SPF), DKIM and DMARC configuration suggestions
Disclosure of known public files or directories (eg robots.txt)
Banner disclosure on common/public services without a PoC
Security header configurations or missing headers
Lack of Secure/HTTPOnly flags on non-sensitive cookies
Abstract possibility of phishing or social engineering attacks, including open redirects and CSRFs
Reports relating to TLS configuration or known protocol, ciphersuite or certificate weaknesses
Denial of Service and Brute Force
Targeted brute force attacks are NOT permitted to discover incorrect or missing rate limits such as checking the rate limit on a password input.

A missing rate limit does not always signify a security issue.

Testing Scope

The following services and endpoints are within the scope of this policy

the Ably website at http://ably.com, with the exception of https://ably.com/api-streamer
ancillary websites at *.ably.com operated by Ably
the production service endpoints at realtime.ably.io and rest.ably.io
functionally equivalent service endpoints at

*-realtime.ably.io
*-rest.ably.io
*.ably-realtime.com
Ably service endpoints served from customer domains via CNAME
All other domains and services are out of scope. In particular, Ably subdomains that are served by third parties such as support.ably.com are out of scope, but those third parties might themselves have applicable vulnerability disclosure policies.


Triage Process


The submission must contain:

• Scope (URL affected) ;
• Type of vulnerability ;
• Description of the impact ;
• Step to reproduce ;
• Ways to exploit with a valid POC ;
• A way to correct;

Please allow time for triage and the vulnerability to be fixed before discussing any findings publicly.

After receiving a submission,  bugbeat will make a best effort to provide a timely first response. We’ll try to keep you informed about our progress throughout the
process.


Rewards

the reward determined based on the severity of the reported vulnerability and product category.
Critical:  0~5.000 USD

High:  0~1.500 USD

Medium: 0~500 USD

Low: 0~150 USD

Program Rules

Bentley Systems requires that all researchers

Avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing.
Perform research only within the scope set out below.
Use the communication channels defined below to report vulnerability information to us.
Keep information about any vulnerabilities you have discovered confidential between you and Bentley Systems until it is fixed.
If you follow these guidelines when reporting an issue to us, we commit

Not to pursue or support any legal action related to your research.
To work with you to understand and resolve the issue quickly.

In Scope vulnerabilities

Brocken Access control (Privilege Escalation)
Business Logic Issues
Cross-Origin resource sharing (CORS)
Cross-Site Request Forgery (CSRF)
Cross-Site Scripting (XSS)
Directory Traversal
DLL hijacking
Hyperlink injection
Identification and Authentication
Insecure direct object reference (IDOR)
Open redirect
Other
Remote Code Execution
Security misconfiguration
Sensitive data exposure
Session misconfiguration
SQL Injection
Subdomain takeover*
Word-press issues



Out of scope vulnerabilities

Publicly released bugs in internet software within 15 days of their disclosure
Spam or Social Engineering techniques, including SPF and DKIM issues
Self-XSS (we require evidence on how the XSS can be used to attack another user)
X-Frame-Options related (clickjacking)
Rate limit vulnerability (unless a valid exploit PoC provided)
XMLRPC.php file is enabled leading to DoS attack
Missing cookie flags on non-sensitive cookies
Missing security headers which do not lead directly to a vulnerability (unless you deliver a PoC)
Header injection )unless you can show how they can lead to stealing user data)
Version exposure (unless you deliver a PoC of working exploit).
Issues that are non-exploitable but lead to crashes, stack trace, and similar information leak or stability issues.
Denial of Service
Anything requiring outdated browsers, platforms, or crypto (i.e. TLS BEAST, POODLE, etc.)
Anything from an automated scan, anything that is already public, or anything not under Bentley Systems control (e.g. Google Analytics, etc.)
Theoretical issues that lack practical severity


Testing Scope

All _.bentley.com subdomains
All Bentley Systems desktop products (Only CONNECT Edition and Later)
All Bentley Systems mobile apps
All Bentley Cloud Applications and Services
All Bentley Open Source Projects (including imodeljs.org)

Out Of Testing Scope

Bentley Systems’ Infrastructure (VPN, Mail Server, SharePoint, Skype, etc.)
Findings from physical testing, such as office access (e.g., open doors, tailgating)
Findings derived primarily from social engineering (e.g., phishing, vishing)
Findings from applications or systems not listed in the ‘Scope’ section
UI and UX bugs and spelling mistakes
Network level Denial of Service (DoS/DDoS) vulnerabilities
Any services hosted by 3rd-party providers and services
https://bentley.matrixlms.com/
https://www.plaxis.ru
https://communities.bentley.com Communities reports should be submitted directly to Telligent.
Synchro Academy reports should be submitted directly to Cypher Learning.
https://ebook.bentley.com/ Ebook reports should be submitted directly to Impelsys.
https://yii.bentley.com/en
https://vshow.on24.com/vshow/bsn012108_ve_01/registration/19990
https://vshow.on24.com/vshow/bsn012108_ve_01/lobby/19990


Triage Process

The submission must contain:

• Scope (URL affected) ;
• Type of vulnerability ;
• Description of the impact ;
• Step to reproduce ;
• Ways to exploit with a valid POC ;
• A way to correct;

Please allow time for triage and the vulnerability to be fixed before discussing any findings publicly.

After receiving a submission,  bugbeat will make a best effort to provide a timely first response. We’ll try to keep you informed about our progress throughout the
process.


Rewards

the reward determined based on the severity of the reported vulnerability and product category, 0~500$ .

[ Guests cannot view attachments ]