
FileZilla (European Commission - DIGIT)
External Program
Submit bugs directly to this organization


External Program
Submit bugs directly to this organization
This project has been sponsored by the European Commission as part of the EU-Free and Open Source Software Auditing (EU-FOSSA) project designed to improve the security of free software. This program will be open for submissions for 8 weeks, though rewards may be processed beyond the 8 week period in order to allow for full evaluation of the impact of valid vulnerability reports.
Note: This program has now been extended for a further two months to 21 July 2019.
While researching, we'd like to ask you to refrain from:
The bug bounty program will test only the fully free open source version of FileZilla as found on https://filezilla-project.org/download.php?type=client&show_all=1 and the source code repository described on https://filezilla-project.org/sourcecode.php which includes the libfilezilla library. Other versions of the program are not in the scope of this testing.
The following components are also explicitly not in the scope:
Vulnerabilities are to be evaluated given contemporary computer architectures.
The PoC must work on the respective repository trunk heads or the latest released version. Older builds are explicitly out of scope.
FileZilla uses the GNU autotools as build system.
It, as well as almost all its dependencies, can be built using the familiar configure && make && make install trinity.
The following two guides have reently been updated and can be used to build FileZilla:
FileZilla directly depends on the following libraries:
FileZilla is organized in different components. The most important components are, identified by subdirectory:
src/engine: The protocol implementationssrc/engine/ftp: FTP specific functionalitysrc/engine/sftp: SFTP specific functionality, wraps around fzsftpsrc/engine/http: Everything specific to HTTP specific functionalitsrc/interface: The user interface and controlling logic such as the transfer queuesrc/putty: Source for fzsftp, a heavily modified version of PuTTY's psftpsrc/fzshellext: The Windows shell extension to facilitate Drag&drop from Explorer into FileZilla.src/engine/directorylistingparser.cpp: The directory listing parser inCTlsSocketImpl::VerifyCertificate in src/engine/tlssocket_impl.cpp: Certificate verificationsrc/interface/updater.cpp: The update mechanismsrc/engine/http/request.cpp: The HTTP state machine capable of request pipelininglib/encryption.cpp: The asymmetric encryption scheme used for the master password functionalityA bonus structure is in place from the 14th of June - 14th of July 2019
Our rewards are based on the severity of a vulnerability. HackerOne uses CVSS 3.0 (Common Vulnerability Scoring Standard) to calculate severity. We will update the program over time based on feedback, so please give us feedback on any part of the program you think we can improve on.
Our rewards are based on the severity of a vulnerability. HackerOne uses CVSS 3.0 (Common Vulnerability Scoring Standard) to calculate severity. We will update the program over time based on feedback, so please give us feedback on any part of the program you think we can improve on.
| SEVERITY | CVSS SCORE | REWARD | Temporary Bonus Structure |
|---|---|---|---|
| critical | 9.0 - 10.0 | €7500 | |
| High | 7.0 - 8.9 | €3250 | |
| Medium | 4.0 - 6.9 | €1300 | |
| Low | 0.1 - 3.9 | €325 |
There is a 20% bonus for including a fix in the report when accepted by the maintainers.
Note: The 20% bonus is calculated off the new bonus structure.
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If you have any questions or concerns on this challenge, please contact [email protected].
Thank you for helping keep FileZilla and our users safe!