DRACOON – Bug Bounty Program
Bounty Range
$1 - $5,000
external program
Bounty Range
$1 - $5,000
external program
BountyHall of fame
$1 Low $500 Medium $1,000 High $3,000 Critical $5,000
Avg reward -
Max reward -
Scopes12
Supported languagesEnglish
Reports292
1st response < 1 day
Reports last 24h2
Reports last week12
Reports this month37
Program description
Program activity
Enabled Leaks and exposed credentials
Enabled Systemic Issues grid
We will move the DRACOON bug bounty program under the Kiteworks umbrella shortly while we do some organisational re-arrangements. This will not have any effect on this program except that the brand Kiteworks will have increased visibility.
We declared an end of life date for DRACOON Server. As a result we will no longer pay bounty for findings of low or medium severity based on CVSS. The bounty for findings of high or critical severity remain unchanged. This change only affects DRACOON Server and not DRACOON Cloud. This change is reflected in the program description as well as the reward grid introducing a new medium tier for all assets related to DRACOON Server.
DRACOON offers secure file sharing and collaboration services with two products, DRACOON Cloud and DRACOON Server. Both products support built-in end-to-end encryption and offer many features tailored for large organizations, such as a complex roles and permissions system, SSO integration, auditing and reporting features.
With this bug bounty program, we want to reinforce our commitment to security and reward security researchers for helping us protect our customers' data.
DRACOON wants to increase the security of its products by inviting security researchers to analyze the implementation of security measures in its product and to identify existing vulnerabilities. In order to achieve this goal together, it is important to us that the following rules are adhered to.
(D)DoS attacks on our infrastructure are strictly prohibited. This includes (but is not limited to) all applications, services, servers and network infrastructure.
Do not carry out load-based attacks (e.g. automated scanners that create a large number of requests).
Do not interfere with any box that is not listed within the program scope.
Do not decommission any boxes.
Do not change network configuration.
Do not change passwords of accounts (unless it’s your own) or delete other accounts.
Do not extract information and disclose it if you should gain access to it irregularly.
Do not alter, modify or delete any information stored in our cloud if you should gain access to it irregularly.
Do not publish (even partially) any vulnerabilities that are found.
We are happy to thank everyone who submits valid reports to improve the security of our cloud service, however only those that meet the following eligibility requirements may receive a monetary reward:
You must be the first reporter of a vulnerability.
The vulnerability must be a qualifying vulnerability (see below).
Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through http://yeswehack.com.
The vulnerability report must contain the following elements:
A clear textual description of the vulnerability, how it can be exploited, its security impact and remediation advice.
A proof of the exploitation of the vulnerability (e.g. screenshots, proof of concept code).
The preconditions and steps required to reproduce the issue including code snippets, commands, request information, payloads, etc.
You must not be a former or current employee of our company or one of its contractors.
As DRACOON Cloud and DRACOON Server share the majority of the source code, we consider the same attack on both systems in scope as duplicate.
DRACOON Server has a declared end of life date. This means that we will not pay bounty for findings of low or medium severity based on CVSS.
Please note that for any reports involving Cross-Site Scripting (XSS), a basic proof-of-concept such as a JavaScript alert box (e.g., alert(1)) will not be considered sufficient for triage or reward. To qualify for a valid report, you must demonstrate a clear and actionable impact resulting from the XSS vulnerability. This includes, but is not limited to:
Performing actions on behalf of another user (e.g., creating a new user account or modifying user settings)
Exfiltrating sensitive data (e.g., sending authentication cookies or session tokens to an external server)
Bypassing security controls or escalating privileges
The goal is to understand the real-world risk and exploitability of the issue, so please ensure your report includes a well-documented and impactful demonstration.
Core - This service is the heart of the backend. It is responsible for file upload, download, sharing, user and role management.
OAuth - Responsible for user authentication. Implements OAuth2.
S3 Storage - Storage location of binary data. Accessible via internet and heavy use of [https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html](pre-signed S3 URLs) to allow direct transfer between client app and storage.
Media - Responsible for image downscaling (e.g. for thumbnails).
Reporting - Responsible for generating various reports triggered by the user (e.g. reports on user activity). Creates PDF and CSV files.
WebDAV - Proxy service that allows to connect to DRACOON via WebDAV protocol.
Branding - Allows customers to customize appearance. Manages customer branding configurations (e.g. logo, email signatures).
Signing - Acts as a proxy to our signing partner FP-Sign. Responsible for sending signing requests and storing signed documents in DRACOON.
Web App - The main web application to access DRACOON via a browser. This is the only full-feature client.
Desktop Apps - Sync client for Windows and Mac. Mounts DRACOON as a virtual disk on the end user’s device.
Mobile Apps - Native apps for Android and iOS, that provide a subset of the features.
MS Teams App - App for MS Teams.
Outlook Add-In - Add-In for MS Outlook. Allows to convert attachments to share links.
Swagger UI - Swagger UI is an interactive API documentation. Most services provide a public Swagger UI client. See useful links section.
Area | Scope Type | Scope URL | DRACOON Cloud | DRACOON Server |
Backend | Core Service | /api | yes | yes |
Backend | OAuth Service | /oauth | yes | yes |
Backend | S3 Storage | https://0-2744452194.s3.nbg01.de.dracoon.io | yes | no |
Backend | Media Service | /mediaserver | yes | no |
Backend | Reporting Service | /reporting[/api] | yes | no |
Backend | WebDAV Proxy | /webdav | yes | yes |
Frontend | Web App | / | yes | yes |
Bug Bounty Environments:
DRACOON Cloud: https://bounty-cloud.dracoon.app
DRACOON Cloud S3 Storage https://0-2744452194.s3.nbg01.de.dracoon.io
DRACOON Server: https://bounty-server.dracoon.app
User manuals, knowledge base:
DRACOON Cloud: https://cloud.support.dracoon.com
DRACOON Server: https://server.support.dracoon.com
Public API documentation (SwaggerUI / OpenAPI 3.0):
DRACOON Cloud
Core Service: https://bounty-cloud.dracoon.app/api
Reporting Service: https://bounty-cloud.dracoon.app/reporting/api
DRACOON Server
Core Service: https://bounty-server.dracoon.app/api
Public SDKs and crypto implementation: https://github.com/dracoon
Whitepaper on e2e encryption: https://cloud.support.dracoon.com/hc/en-us/articles/360000986345-Whitepaper-Client-side-Encryption
Asset value | CVSS Low | CVSS Medium | CVSS High | CVSS Critical | High | $500 | $1,000 | $3,000 | $5,000 | Medium | $0 | $0 | $3,000 | $5,000 |
1st report100% 2nd report100% 3rd report75% 4th report50% 5th report25% 6th+ report10%
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Scope | Type | Asset value | Expand rewards grid | https://bounty-cloud.dracoon.app/api | API | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://bounty-cloud.dracoon.app/oauth | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://0-2744452194.s3.nbg01.de.dracoon.io | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://bounty-cloud.dracoon.app/mediaserver | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://bounty-cloud.dracoon.app/reporting/api | API | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://bounty-cloud.dracoon.app/webdav | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://bounty-cloud.dracoon.app/ | Web application | High | | Low $500
Medium $1,000
High $3,000
Critical $5,000
| https://bounty-server.dracoon.app/api | API | Medium | | Low $0
Medium $0
High $3,000
Critical $5,000
| https://bounty-server.dracoon.app/oauth | Other | Medium | | Low $0
Medium $0
High $3,000
Critical $5,000
| https://bounty-server.dracoon.app/reporting/api | API | Medium | | Low $0
Medium $0
High $3,000
Critical $5,000
| https://bounty-server.dracoon.app/webdav | Other | Medium | | Low $0
Medium $0
High $3,000
Critical $5,000
| https://bounty-server.dracoon.app/ | Web application | Medium | | Low $0
Medium $0
High $3,000
Critical $5,000
|
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Type of leak Source of leak is in-scope Source of leak belongs to the Organization and is out-of-scope Source of leak does not belong to the Organization and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset) Eligible Eligible Not eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset) Eligible Not eligible Not eligible
You will receive full admin access to the respective systems. Please request an account by filling the following form: https://content.kiteworks.com/af/f-iPR2g5z7jpDeG3frGwE3wW/dracoon-public-bug-bounty-program. We will only create accounts for YesWeHack email alias.
After submitting the form using your YesWeHack email alias, we will create the admin accounts within 24 hours. Please watch out for welcome emails containing initial passwords from the two systems.
Please append to your user-agent header the following value: ' -bug-bounty-yeswehack '.
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.
For more information, see [https://helpcenter.yeswehack.io/hunter/hunter-collaboration](help center). Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.
To submit a vulnerability report, you need to login with your hunter account. /programs/dracoon-bug-bounty-program/create-report