Summer Special Campaign

• From 29/07/2024 to 15/08/2024

Summer Special Campaign conditions.

We are excited to announce our special summer bug bounty campaign, where we will be offering up to 2x payouts for Critical and High severity vulnerabilities. To clarify, during this special summer campaign, only the following vulnerability categories are included:

Critical Vulnerabilities categories x2 (Up to 10K):

• Remote Code Execution (RCE)
• SQL Injection (SQLi)
• Any other vulnerabilities that result in massive exposure of user Personally Identifiable Information (PII) within our platform.

High Severity Vulnerabilities categories x2 (Up to 4k):

• One-Click, One-User Account Takeover (ATO)
• Payment Bypass

Thank you for your continued support and participation

#Brand Promise

The safety and security of our customers, suppliers and employees’ data and any sensitive information, as well as the reliability of the IT services we use to manufacture and market our products, are of utmost importance to the Inditex Group (hereinafter, “Inditex”). It is our compromise to deter any action directed against the confidentiality, integrity and availability of our computer systems, networks, and computer data as well as the misuse of such systems, networks and data for fraudulent activities, cybercrime offences or against the safety and security of our customers, suppliers, and employees.

An effective fight against these matters requires, on the one hand, to collaborate with institutions and authorities to try to assist in order to mitigate the commission of cybercrimes or illegal actions; on the other, to design and implement this Vulnerability Disclosure Policy (hereinafter, “Policy”), which describes the Inditex’s terms and conditions with regard to any unsolicited report related to potential IT vulnerabilities which can be exploited by threat actors against us, our customers, suppliers or employees.

Inditex cares deeply about maintaining trust and confidence and strongly believes that close collaboration with researchers and reporters improves security. If you are a security researcher or a reporter who has found a vulnerability in an Inditex service, we would like to hear from you.

According to the ENISA definition, vulnerability is ‘flaws’ or ‘mistakes’ in computer-based systems that may be exploited to compromise the network and information security of affected systems.

Reporters must review, understand, and abide by the following terms and conditions included in the Policy before conducting any research or testing. In addition, Inditex encourages reporters to act in a responsible way in the reporting process.

Reporter compliance with terms and conditions of this Policy will be considered by Inditex as an authorized conduct in accordance with regulations included in national laws. Failure to abide terms and conditions will result in the loss of being considered a security researcher or reporter under the Policy.

Inditex reserves all legal rights in the event of any non-compliance with this Policy or in case of non-compliance with local laws.

Company

Inditex is one of the world's largest fashion retailers, with seven brands (Zara, Pull&Bear, Massimo Dutti, Bershka, Stradivarius, Oysho, Lefties and Zara Home) selling in 202 markets through its online platform or its over 7,000 stores in 96 markets.

Mission

Security is one of Inditex's core values and we want you to help us to improve the security of our technical infrastructure.

In return, we will pay you with a monetary reward. Reward amounts may vary depending upon the severity of the vulnerability reported and quality of the report.

Depending on their impact, not all reported issues may qualify for a monetary reward. However, all reports are reviewed on a case-by-case basis and any report that results in a fix, would be rewarded.

To qualify for a reward, you must:

• Report a qualifying vulnerability that belongs to the scope (see below).
• Be the first person to report it.
• Communicate with our security team exclusively through this platform.
• Comply with all the terms and conditions detailed below.

Customers, users, researchers, partners, and any other person that interacts with Inditex’s IT services may voluntarily report in good faith any potential security vulnerabilities to us. Public disclosure of the submission details of any identified or alleged vulnerability without express written consent from Inditex will deem the submission as noncompliant with this Policy.

Inditex do not accept, review, or consider any unsolicited ideas, works, materials, proposals, suggestions, or the like, including for products, services, technologies, product enhancements, processes, marketing strategies, product names, content, or creative materials (all the foregoing “unsolicited idea submissions”). Do not send or provide any unsolicited idea submissions in any form to Inditex. Should you ignore our request and you still submit them, then regardless of what your correspondence says, you agree that: (1) your unsolicited idea submissions and their contents along with related intellectual property rights will automatically become the property of Inditex, without any compensation to you; (2) Inditex may use or redistribute the unsolicited idea submissions and their contents for any purpose and in any way on an unrestricted basis; (3) there is no obligation for Inditex to review the submissions; and (4) there is no obligation to keep any submissions confidential.

#Rewards

• Rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard)
• All bounty amounts will be at the discretion of the Inditex Bounty Bug Bounty team.
• Reports submitted using methods that violate policy rules will not be eligible for a reward.
• To be eligible for a reward, the report must be for bounty eligible assets as defined in the scope section of our policy.
• Multiple reports describing the same vulnerability against multiple assets or endpoints where the root cause is the same will be treated as one report. Do not submit duplicate reports for the same issue across multiple sites, as the duplicates will be closed, and the issue will be treated as one report.
• While we aim for consistency, previous reports and prior bounty amounts will not set a precedent for future report eligibility or severity.
• Understand that there could be submissions for which we accept the risk, have other compensating controls, or will not address in the manner expected. When this happens, we will act as transparently as we can to provide you with the necessary context as how the decision was made.

#Scope exclusions

• Inditex Bounty reserves the right to add to and subtract from the Exclusions list depending on the evaluated severity of reported vulnerabilities and risk acceptance.
• Clickjacking/UI redressing
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
• Logout and other instances of low-severity Cross-Site Request Forgery (e.g. add to cart)
• Add or remove users from newsletters
• Attacks requiring MITM or physical access to a user's device
• Previously known vulnerable libraries without a working Proof of Concept
• Comma Separated Values (CSV) injection without demonstrating a vulnerability
• Missing best practices in SSL/TLS configuration
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Any activity that could lead to the disruption of our service (DoS), including but not limited to, inundating support services with invalid requests
• Brute force oracle attacks against unauthenticated endpoints
• Missing best practices in Content Security Policy
• Missing HTTP Only or Secure flags on cookies
• Missing email best practices (Invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g., stack traces, application or server errors)
• Tabnabbing
• Issues that require unlikely user interaction by the victim
• Any issues regarding single session features/management
• Any hypothetical flaw or best practice without exploitable POC
• Any hypothetical flaw or best practice where you are not able to achieve something that you shouldn't be able to do
• Non-critical/high information disclosure
• User enumeration
• Stack traces or path disclosure
• Missing autocomplete attributes
• Customer leaked credentials
• Weak CAPTCHA
• Self-Client-side injection (XSS, Angular, Vue, HTML...)
• Lack of rate-limit/anti-automation
• Findings related to outdated swagger version and related vulnerabilities
• Open redirect: unless an additional security impact can be demonstrated (other than social engineering)

Severity

We base the severity of the reports on CVSS v3.1 (the Common Vulnerability Scoring Standard). Also, our rewards are based on severity, so we pay more when the severity is proven to be more critical. Please note these are general guidelines, and reward decisions are up to the discretion of Inditex.

Any report's severity can be escalated before and after its creation if necessary and proven (e.g., XSS to ATO, HTMLi to XSS, etc...). Any escalation path must be genuine. Different reports using the same escalation path will be treated as the base case (severity without escalation), and only the first will be considered escalated on severity. Only if the new escalation path ends in a bigger severity than the original one will be considered as valid (despite of sharing some base path with other reports)

The base score for a reflected XSS in the ecommerce will be 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). We assume that you will be able to access information inside session context (e.g., address, name, email, etc...), and you will be able to modify some data from the user or the DOM. Regarding Scope (S) in CVSS vector, despite being classified in some sites as "changed", we consider that the true impact of XSS lies in access to the user's session, and, therefore, affects a resource managed by the same security authority.

Any report that requires special conditions beyond the attacker's control will have Attack Complexity (AC) as High (H) such as, but not exclusively, XSS when need special user interaction (onmouseover, onclick, etc...), any report that requires special uncommon conditions from the victim.

#Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct, and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will make it known that your actions were conducted in compliance with this policy. Inditex Bounty reserves all legal rights in the event of noncompliance with this policy.

#Program Eligibility

• You agree and adhere to the Program Rules and Legal terms as stated in this policy.
• You are the first to submit a sufficiently reproducible report for a vulnerability in order to be eligible for the report to be accepted and Triaged.
• You are available to supply additional information, as needed by our team, to reproduce and triage the issue.
• Publically-known Zero-day/One-day vulnerabilities will not be considered for eligibility until more than:
  • 48h have passed since patch availability on Critical vulnerabilities.
  • 5 days have passed since patch availability on Hight vulnerabilities.
  • 60 days have passed since patch availability on Medium/Low vulnerabilities.
• Out-of-scope vulnerability reports or reports that are technically reproducible but pose a very low security impact are likely to be closed as Informative.
• Inditex employees and third-party assets employees are not eligible for participation in this program.

#Program Rules

Do

• Read and abide by the program policy.
• Please append to your user-agent header the following value: '-inSec-CrowdPowered'.
• Perform testing using only accounts that are your own personal/test accounts or an account that you have explicit permission from the account holder to utilize.
• Exercise caution when testing to avoid negative impact to customers and the services they depend on.
• STOP testing if you are unsure about the impact it may have on our systems. If you think you may cause, or have caused, damage with testing a vulnerability, report your initial finding(s) and request authorization to continue testing.
• Avoid further exploitation after a vulnerability it's found, just required to produce a functional PoC, for instance:
  • For RCE PoC would be enough to perform whoami ; uname, no need to compromise the entire OS.
  • For SQLi, it would be enough to print the DB banner or show the DB name, username, table names, but no need to dump the entire DB...
  • Other techniques and procedures for lateral movement, post-exploitation or establishing persistence through back-doors are completely forbidden.

Do NOT:

• Do not Brute force credentials or guess credentials to gain access to systems.
• Do not participate in denial-of-service attacks.
• Do not upload shells or create a backdoor of any kind.
• Do not engage in any form of social engineering for Inditex employees, customers, or vendors.
• Do not engage or target any Inditex employee, customer, or vendor during your testing.
• Do not attempt to extract, download, or otherwise exfiltrate data that you believe may have PII or other sensitive data other than your own.
• Do not change passwords of any account that is not yours or that you do not have explicit permission to change. If ever prompted to change the password of an account you did not register yourself or an account that was not provided to you, stop, and report the finding immediately.
• Do not do anything that would be considered a privacy violation, cause destruction of data, or interrupt or degrade our service. Do not interact with accounts you do not own or without the explicit permission of the account holder.

#Disclosure Policy

The following principles are considered key aspects of this Policy:

• Good faith.
• Lawfulness of activity.
• Data Protection.
• Security of information.
• No extortion nor bribery.
• Security improvement: don’t leave any system more vulnerable than before the test.
• Third party ownership: don’t disturb, compromise, or damage data or property owned by third parties.

Inditex encourages to not do harm and not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability. Avoid accessing the content of any communication, data or info transiting or stored on Inditex domains and info systems mentioned above except to the extent that is directly related to a vulnerability.

Once the reporter finds vulnerability or encounters sensitive data must stop testing and notify the findings to Inditex.

You may not discuss this program or any vulnerabilities (even invalid and resolved ones) outside the program without express consent from the organization. If you are interested in sharing any information about your testing methodology related to an Inditex report, you must request permission on your report, and you must receive written approval from an Inditex team member.

Your Commitment

By making a report to Inditex using the form on this page, or otherwise communicating a report to Inditex, regarding vulnerabilities, you agree to the following terms:

• Respect our privacy. Specifically:
  • If you access anyone else’s data, personal, or otherwise in the course of your research, please contact us immediately so we can investigate. This includes usernames, passwords, and other credentials. The mentioned data is confidential. Please report to us what data was accessed and delete the data. You must not save, copy, download, transfer, disclose or broadcast this information.
  • You agree not to process any personal data to which you, directly or indirectly, have incidental access and/or may know information which implies access to personal data except for the purpose of communicating it to Inditex. In this case, it will be done with the utmost confidentiality, in compliance with the principles established in the data protection laws and regulations, and solely for the purposes set forth in this Policy, and in particular the storage limitation and integrity and applying the necessary technical and organizational security measures.
• Act in good faith. You should report the vulnerability to us with no conditions attached.
• You agree not to access, download, or modify data residing in an account that does not belong to you.
• You have not exploited or used in any manner and will not exploit or use in any manner (other than for the purposes of reporting to Inditex), the discovered vulnerabilities.
• You have not engaged, and will not engage, in testing/research of systems with the intention of harming Inditex, its customers, employees, partners or suppliers.
• You have not used, misused, deleted, altered, or destroyed, and will not use, misuse, delete, alter, or destroy, any data that you have accessed or may be able to access in relation to the vulnerability discovered.
• You have not conducted, and will not conduct, social engineering, spamming, phishing, denial-of-service, or resource-exhaustion attacks or unsolicited mail.
• You are not authorized to attack any device or account other than your own.
• You have not tested, and will not test, the physical security of any property, building, plant, or factory of Inditex.
• You have not breached, and will not breach, any applicable laws in connection with your report and your interaction with Inditex product or service that led to your report.
• You agree not to disclose to any third party any information related to your report, the vulnerabilities reported, nor the fact that a vulnerability has been reported to Inditex.
• You agree not to test in a manner that would degrade or affect the operation of any Inditex systems or compromise the privacy and security of our customers. You shall not test disturbing or corrupting Inditex operations or services.
• You agree not to post, transmit, upload, link to, send, or store any malicious software.
• You agree not to breach third party intellectual property rights.
• You agree not to access, download, or modify data residing in an account that does not belong to you.
• Inditex does not guarantee that you will receive any response from Inditex related to your report. Inditex will only contact you regarding your report if Inditex deems it necessary.
• You agree not to disclosure any vulnerability without written express consent from Inditex.
• You agree to submit vulnerabilities using the form included in this website.
• You agree not to use your relationship with Inditex for marketing or financing activities.
• You agree to destroy/delete any information regarding vulnerability once communicated to Inditex.
• Inditex may use your report for any purpose deemed relevant by Inditex, including without limitation, for the purpose of correcting any vulnerabilities that are reported and that Inditex deems to exist and to require correction. Should you propose any changes and/or improvements to an Inditex product or service in your report, you agree that you are submitting an “unsolicited idea submission” which shall be subject to the specific terms and conditions described in the Scope section of this Policy.
• Inditex reserves all its legal rights in the event of noncompliance with this Policy, but in accordance with safe harbor policy it does not intend to pursue legal civil or criminal action against any party that conducts security research and discloses information to us in good faith and as outlined in this Policy
• You know and agree that Inditex does not take any responsibility nor liability as regards any participation of any other party (if applicable) that could happen as part of the process of verification or related in any manner whatsoever with this page and its aim. Inditex is not responsible for reporters’ liabilities coming from actions performed on third parties. Inditex cannot authorize any activity on third parties’ products or guarantee they will not pursue legal actions against reporters.
• You represent and warrant that the unsolicited idea submissions and the reports you deliver to us do not infringe upon any third parties’ rights, including, without limitation, intellectual property rights.

How to report Vulnerabilities

We encourage security researchers and reporters to share the details of any suspected vulnerabilities with Inditex. Your submission will be reviewed and validated to determine if the finding is valid and has not been previously reported. The preferred method for contacting Inditex regarding such vulnerabilities is by using the form present on this page. The form prevents reporters from having to spend valuable time and resources looking for appropriate contact. By submitting it you confirm that you have read, understand, and agree with the terms and conditions of this Policy.

We require security researchers to include detailed information with steps for us to reproduce the vulnerability. If you identify a valid security vulnerability in compliance with this Policy, Inditex commits to working with you to understand and validate the issue and address the risk (if deemed appropriate by Inditex).

Inditex highly appreciates the efforts made by the reporting party in identifying the vulnerability. Reporting of such vulnerabilities as soon as possible are detected will contribute to improving the security and reliability of our services.

• Supplying your contact information with your report is entirely voluntary and at your discretion.
• Inditex will make use of all reports that are submitted; both those submitted anonymously and those with contact information.
• If you do submit your contact information, the data controller will be Industria de Diseño Textil, S.A. (Inditex, S.A.), with postal address Avda. de la Diputación, Edificio Inditex, 15143, Arteixo (A Coruña), España, which will only use such information to contact you regarding clarifying the details of your report, if that is necessary, and for any other kind of managements related to the report. The legal basis for the data processing is the execution of the conditions established in this Policy. We may share your contact information with service providers and collaborators that give us support with the management and the execution of this Policy. You may contact the data protection officer through the email address [email protected], and contact the data controller in the same email address to exercise your data protection rights, including the reference “Vulnerability Disclosure Policy”, and for further information about the processing of your personal data. Your contact information will be stored until it is necessary for the above-mentioned purpose and for the compliance of legal obligations. Likewise, we inform you that you have the right to file a claim before the responsible data protection regulatory authority (https://www.agpd.es/portalwebAGPD/index-ides-idphp.php).

Apart from the above and as part of your disclosure please provide the following information:

• Solid and adequate evidence to prove the existence of the vulnerability (screenshot, link, etc.)
• Timeline or some information about the moment the vulnerability was discovered.
• Any type of information deemed necessary to identify, locate and resolve the vulnerability in the fastest and most efficient way possible.

#Legal

Inditex reserves the right to modify the terms and conditions of this program, and your participation in the Program constitutes acceptance of all terms. Please check this site regularly as we routinely update our program terms and eligibility, which are effective upon posting. You can subscribe to receive email notifications when this policy is updated.

#F.A.Q.

1. Can I get Inditex swag? Inditex Bounty does not currently offer swag

2. What language can I use for my report? Feel free to write your report in (ES) 🇪🇸 / (ENG) 🇬🇧.

3. Can Inditex provide me with a pre-configured test account? This program does not provide credentials or any special access

4. What is required when submitting a report?

5. How do I make my report great?

6. I submitted a report. Now what? I have questions.

7. What causes a report to be closed as Informative, Duplicate, N/A, or Spam?

8. What is an example of an accepted vulnerability? Valid and accepted vulnerabilities would be the type of report that identifies a unique security impact on this program’s specific scope. The report must also meet any submission criteria outlined in the policy, such as test plan instructions and a working proof of concept.