Scope and RoE

Guidelines

The DOE appreciates your effort to help strengthen our cyber posture. As part of your good faith testing or research efforts, the Department requests that Reporters:

• Notify the Department as soon as possible after you discover a real or potential security issue using the process outlined herein;
• Provide us with a reasonable amount of time to resolve the issue before you disclose it publicly or to additional parties;
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data;
• Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or use the exploit to “pivot” to other systems;
• Cease and desist all testing activities if you establish that a vulnerability exists or encounter any sensitive data (e.g., including personally identifiable information, financial information, or proprietary information or trade secrets of any party), notify the DOE immediately, and not disclose this data to anyone else. Sensitive information identified may be covered under other Federal or legal requirements, regulations, or safeguarding measures that supercede the protections and authority of the Department’s Vulnerability Disclosure Program and these rules of engagement; and
• Avoid submittal of a high volume of low-quality reports by using the Common Vulnerability Scoring System (CVSS) or other similar methodology to assess the significance of a vulnerability prior to submitting it. Examples of potential low-quality or low impact vulnerabilities include but are not limited to the "Low Impact Vulnerabilities" found below

Low Impact Vulnerabilities - Out of Scope

The following vulnerabilities are considered too low of an impact to the client and would be marked as Out of Scope if submitted:

• Google Maps API Keys
• Account/e-mail enumeration using brute-force attacks
  • Valid user account/email enumeration not requiring brute-force will be considered
• Any low impact issues related to session management (i.e. concurrent sessions, session expiration, password reset/change log out, etc.)
• Bypassing content restrictions in uploading a file without proving the file was received
• Clickjacking/UI redressing
• Client-side application/browser autocomplete or saved password/credentials
• Descriptive or verbose error pages without proof of exploitability or obtaining sensitive information
• Directory structure enumeration (unless the fact reveals exceptionally useful information)
• Incomplete or missing SPF/DMARC/DKIM records
• Issues related to password/credential strength, length, lockouts, or lack of brute-force/rate limiting protections
  • Account compromises (especially admin) as a result of these issues will likely be considered VALID
• Lack of SSL or Mixed content
  • Leaking Session Cookies, User Credentials, or other sensitive data will be reviewed on a case by case basis
  • If leaking of sensitive data requires MiTM positioning to exploit, it will be considered out of scope
• Login/Logout/Unauthenticated/Low-impact CSRF
  • CSRF Vulnerabilities may be acceptable if they are of higher impact. Examples of low impact CSRF include: Add/Delete from Cart, Add/remove wishlist/favorites, Nonsevere preference options, etc.
• Low impact Information disclosures (including Software version disclosure)
• Missing Cookie flags
• Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability
• Reflected file download attacks (RFD)
• Self-exploitation (i.e. password reset links or cookie reuse)
• SSL/TLS best practices that do not contain a fully functional proof of concept
• URL/Open Redirection
• Use of a known-vulnerable library which leads to a low-impact vulnerability (i.e. jQuery outdated version leads to low impact XSS)
• Valid bugs or best practice issues that are not directly related to the security posture of the client
• Vulnerabilities affecting users of outdated browsers, plugins or platforms
• Vulnerabilities that allow for the injection of arbitrary text without allowing for hyperlinks, HTML, or JavaScript code to be injected
• Vulnerabilities that require the user/victim to perform extremely unlikely actions (i.e. Self-XSS)
  • Self-XSS for a Persistent/Stored XSS will be considered. The only circumstances under which we will not require proof of impact to multiple users is for Persistent/Stored XSS in cases where only one set of credentials is available to the researcher and other users cannot be tested. We will require documentation or evidence reasonably proving the functionality is available to other users/backend team/admin for the report to be considered.
  • Any type of XSS that requires a victim to press an unlikely key combination is NOT in scope (i.e. alt+shift+x for payload execution)

Additional specific vulnerability types considered out of scope due to low impact:

• IIS Tilde File and Directory Disclosure
• SSH Username Enumeration
• Wordpress Username Enumeration
• SSL Weak Ciphers/ POODLE / Heartbleed
• CSV Injection
• PHP Info
• Server-Status if it does not reveal sensitive information
• Snoop Info Disclosures

Mandatory Requirements

The following types of research testing methods are prohibited and are in violation of the Department’s Vulnerability Disclosure Program and protections:

• No security testing is authorized on industrial control systems managed by DOE, but we welcome reports of information security concerns;
• Network denial of service (DoS or DDoS) tests;
• Physical testing (e.g. office access, open doors, tailgating);
• Social engineering (e.g. phishing, vishing); and
• Any other non-technical vulnerability testing.

Any testing that deliberately results in the following is also prohibited by the Program:

• Privacy violations;
• Degradation of user experience;
• Disruption to production systems;
• Destruction, manipulation, or exfiltration of data;
• Establishment command line access and / or persistence; and
• Access to out-of-scope systems.

Scope