Welcome to Fifth Third Bank Vulnerability Disclosure Program!

Fifth Third Bank, National Association is dedicated to proactively advance our security, identify new vulnerabilities and help keep our customer information secure. We value the important role of the security community in helping us mitigate information security risk as the threat landscaping continuous to evolve.

Response Targets

Fifth Third Bank will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

• Follow HackerOne's disclosure guidelines.

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may be closed as Information or N/A.
• Multiple vulnerabilities caused by one underlying issue will be treated as one vulnerability; the first report will be triaged as the original, and all future reports will be closed as Duplicate.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
• Only interact with accounts you own or with explicit permission of the account holder.
• Large-scale vulnerability scanners, scrapers, or automated tools which produce excessive amounts of traffic are prohibited at this time.

To participate in our program we ask that you configure your tools accordingly. This will help us best determine that you are a researcher participating in our program and will help reduce they likelihood that you are blocked from our systems.

(1) HTTP Headers:

Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests

Identifier: Your Username Format: X-Bug-Bounty:HackerOne- Example: X-Bug-Bounty: HackerOne-flyingtoasters

Identifier: Tool Identifier Format: X-Bug-Bounty: Example: X-Bug-Bounty: BurpSuitePro

(2) @wearehackerone.com email alias:

For anything that requires credentials researchers must use their @wearehackerone.com email alias as part of the HackerOne platform.

Known issues

Please note that the Fifth Third Security Team also actively looks for vulnerabilities across all assets internally. For reported issues that are already known to us, we will close them as duplicates. We seek your kind cooperation to respect our final decision and to refrain from making multiple negotiations once the decision has been made.

Qualifying Vulnerabilities (In Scope)

We are interested in the following types of vulnerabilities:

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Insecure Direct Object References (IDOR)
• Injection Vulnerabilities
• Authentication Vulnerabilities
• Server-Side Code Execution
• Privilege Escalation
• Directory Traversal
• Information Disclosure
• Open Redirects

Non-Qualifying Vulnerabilities (Out of Scope)

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope.

The following issues are considered out of scope:

• We do not accept purchased credentials from the web/dark web without an associated vulnerability (we only accept credential submissions when they are directly tied to a vulnerability being actively reported or if the vulnerability demonstrates how the credentials were compromised)
• Multiple small credential submissions that could reasonably be included in a single report
• Credentials obtained from 3rd party breaches without demonstrating a direct impact on our systems (any credential submissions that do not meet these requirements will be close as Not Applicable)
• No reports will be accepted that require sending a user malware
• Tabnabbing
• Publicly accessible login panels
• Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin: * or accepting of custom Origin header that do not specifically show a valid attack scenario.
• Reports from automated tools or scans
• Host Header Injection (Unless it gives you access to interim proxies)
• IP Address Disclosure
• Bugs in content/services that are not owned/operated by 5/3.
• CSRF on forms that are available to anonymous users.
• Clickjacking and issues that are only exploitable through clickjacking.
• Descriptive error messages (e.g. Stack Traces, application or server errors) that have no security implications.
• HTTP 404 codes/pages or other HTTP non-200 codes/pages.
• Fingerprinting / banner disclosure on common/public services.
• Disclosure of known public files or directories, (e.g. robots.txt, crossdomain.xml, p3p.xml).
• Lack of Secure and HTTPOnly cookie flags.
• Email configuration issues (SPF, DKIM, DMARC).
• Forced Login / Logout CSRF.
• Account lockout by repetitive incorrect password submissions.
• Password complexity or account recovery policies.
• HTTPS Mixed Content.
• Missing HTTP security headers, specifically: Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, and Content-Security-Policy.
• OPTIONS HTTP method enabled.
• Missing best practices in SSL/TLS configuration
• Use of a known-vulnerable library without evidence of exploitability.
• Attacks requiring physical access to a user’s unlocked device.
• Reports of spam, phishing, or security best practices.
• Issues that require unlikely user interaction.
• Attacks requiring MITM or physical access to a user's device.
• Information disclosures that only reveal email address or phone numbers.
• Information Disclosure: If a document is deemed not actually sensitive or classified, then Fifth Third Bank will mark it as informational and close the vulnerability

Test Instructions

• All assets in scope are on production; no VPN or credentials are required for testing.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Fifth Third Bank and our users safe!