Airbnb
External Program
Submit bugs directly to this organization
Airbnb
Welcome! Airbnb is committed to building and protecting the world's most trusted community. If you believe you have discovered a potential security vulnerability with Airbnb's online systems, we appreciate your help in responsibly disclosing the issue to us.
Please submit a detailed description of the issue and the steps you believe may be required to reproduce what you have observed. In doing so, please take the utmost care to protect our users’ privacy, data confidentiality, and integrity. The privacy of our community is crucial, and we very much value your assistance in preserving it. Please understand that we cannot work with anyone who violates applicable laws or regulations, attempts to maliciously exploit a security issue, or access other user’s data. Note: Abusing vulnerabilities in other websites in order to test Airbnb is prohibited. Provided that you’ve made a good faith effort to abide by this policy, we will not take legal action against you or ask law enforcement to investigate you.
Upon receipt of your report, we will communicate timelines for triaging, paying out your report, and answer questions during the investigative period. A detailed description of the vulnerability and reproduction steps are required for each report. If you do not provide this information within 2-business days from the submission of the report, we will close the report as Not Applicable.
Note: Timelines as shown below are based upon receipt of a fully detailed vulnerability with reproduction steps provided with the submitted report.
| Communication | SLA |
|---|---|
| Initial Communication | Upon receipt of new report |
| Triage | 2-business days from receipt of new report |
| Bounty Payout | 5-business days from Triage |
| Response to Researcher questions | 2-days from posted question |
This program is dedicated to perceived online security issues that may affect many people on Airbnb. If you're having issues related to your individual account, please visit our Help Center.
Certain vulnerabilities with a working proof of concept on some of our Android mobile app(s) may qualify for an additional bounty through the Google Play Security Rewards Program. To see which apps and vulnerabilities may qualify for a bounty, please refer to the [Google Play Security Rewards Program’s Scope and Vulnerability Criteria]https://bughunters.google.com/about/rules/5604090422493184/google-play-security-reward-program-rules
In Scope assets are listed https://hackerone.com/airbnb/policy_scopes and are reviewed on a quarterly basis to ensure the most inclusive scope possible.
Our maximum bounty is $25,000 USD. Reward amounts are based on Severity and overall impact. We encourage you to use the CVSS calculator in HackerOne to calculate the severity you believe is adequate to your finding. If we believe the Severity you calculated is different from our assessment, you will be provided with an explanation as this may impact payout. Please allow up to 5 business days from time of triage for bounty to be paid out. The following table outlines the typical bounty ranges by Severity. All bounties are up to the discretion of Airbnb.
High Impact Scope Payout Range
| Severity | Payout Range |
|---|---|
| Critical | $18,000 - $25,000 |
| High | $10,000 - $17,999 |
| Medium | $1000-$5000 |
| Low | $250 |
Low Impact Scope Payout
| Severity | Payout |
|---|---|
| Critical | $5000 |
| High | $3000 |
| Medium | $500-$1000 |
| Low | $250 |
Vulnerability Type|Severity Range| |-------------------|-----------------|-----------------| | Remote Code Execution (RCE) | Critical | | SQL Injection | High - Critical | | Improper Direct Object Reference (IDOR) | Medium - Critical | | Sensitive Data Exposure| Medium - Critical | | Server Side Request Forgery (SSRF) | Low - Critical | | Local file Inclusion | Medium - High | | Stored Cross Site Scripting | Medium - High | | Significant Authentication Bypass | Medium - High | | Authorization Flaw | Medium - High | | Cross-Site Request Forgery (CSRF) | Low - Medium | | Open Redirect on Sensitive Parameter | Low - Medium | | Reflected/Other Cross Site Scripting | Low - Medium | | Open Redirect | Low - Medium | | DNS Subdomain Takeover | Low - Medium |
##Highest Impact Scope
*.airbnb.com*.airbnb.org*.musta.ch*.airbnbpayments.comes.airbnb.com, it.airbnb.com)These properties are considered to have lower security impact on our users since they should not have access to Airbnb user sessions and generally cannot access user data. The bounties given for reports on these properties will therefore be significantly lower.
*.atairbnb.com*.withairbnb.com*.airbnbcitizen.com*.byairbnb.com*.muscache.com*.airbnb-aws.com*.luxuryretreats.com*.airbnbopen.comhoteltonight-test.com*.hoteltonight.comapi.hoteltonight-test.complaces.hoteltonight-test.comPlease remember that reward decisions are up to the discretion of Airbnb. We do not reward duplicate reports.
Airbnb reserves the right to decide the weakness and severity of a report and whether the vulnerability was previously reported. Rewards are granted entirely at the discretion of Airbnb.
To qualify for a reward under this program, you should:
A good Bug Bounty report should include the following information at a minimum:
When reporting vulnerabilities, please consider the attack scenario, exploitability, and security impact of the bug. The following issues are considered out of scope, and we will NOT accept any of the following types of attacks:
(Hidden by Airbnb) (other content redaction vulnerabilities are in scope)hoteltonight.comhoteltonight.buildhoteltonight-test.compartners.hoteltonight.com)Researchers can create customer accounts and book hotel rooms (test bookings) using a fake credit card in our testing environment, which doesn’t send out any email notifications (activation or confirmation) to customers.
HotelTonight Mobile Web App
HotelTonight Mobile APIs Mobile APIs that power our mobile apps are located at:
HotelTonight Cities and Inventory In our testing environment, you should search for following cities to look for hotels:
HotelTonight Access You can create customer accounts using your emails (no activation emails will be sent), and use the following credit card for test booking a hotel room: - 4111111111111111 (Visa) with any expiration date in the future. Additional test payment methods available at https://developers.braintreepayments.com/reference/general/testing/ruby#credit-card-numbers (use only American Express, Discover, JCB, Mastercard, or Visa). All test bookings are not real bookings. We also suppress all emails for test bookings, so no email receipts will be sent to whatever email address is entered.
HotelTonight Credentials Researchers will need to self-provision the customer accounts by signing up using their email on our mobile web app. You will not get any activation email from our testing environment.