By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Raidboxes Dashboard

Our Raidboxes dashboard is the management console for our customers to maintain and operate the hosting side of their WordPress sites so called "Boxes".
It allows for easy one-click server settings management and options from performance to security settings.
A Raidboxes dashboard user can create their own instances of Boxes and manage it in their account without any help from our team.

Some attack vector ideas:

• Accessing other user's Boxes would be an incredible finding
• Read/Change PII data of other users on the Raidboxes Dashboard (For example: read the full name, street address or payment data of another user).
• Read/Change data of other user's Boxes on the Raidboxes Dashboard (For example: changing the PHP Version of a Box of another user).
• Database access to our system's database (not WordPress database of Boxes, this feature is intentional).
• Privilege escalation to a super-admin user.

Boxes

Boxes are WordPress Instances hosted on our own Infrastructure.

Info

• All Boxes run on the same tech stack (WordPress) and are only limited in resources according to the user purchased plan.
• File-System access is granted via SFTP right after creation of the BOX (same credentials as your Dashboard login).
• All Boxes all have open HTTP(s) Ports as well as SSH Ports, however that SSH access needs to be enabled for your user via your BOX settings in the Dashboard. (public key must be present in your user profile)

Some attack vector ideas:

• The SSH user "wp" has limited access in their own chroot - if you manage to break out of it or even get root or run commands as root, that would be an amazing finding.
• Our "must-use" plugins within the WordPress environment of the Boxes might be a good attack vector, if you find High/Critical vulnerabilities there, that would be great.

Feedback
Would you like to help us improve our program or have some feedback to share, please send your anonymous feedback here:

Program feedback link
Please note this form will be checked periodically and should not be used for submission or support queries.

Application

• Non-obfuscated (clear text) password for basic auth credentials in Box Overview.
• Generative password for basic auth credentials for Boxes.
• Testing of sites hosted on *.myraidbox.de, which you do not own.
• Anything related to a WordPress flaw or third party plugin/theme/extension flaw, however our own "must-use" plugins are in scope.
• Information disclosure or DoS through native WordPress functionality, including wp-json, xmlrpc, oembed, or other REST API endpoints.
• CORS misconfiguration on non-sensitive endpoints
• Missing cookie flags
• Missing security headers
• Missing CSP “report-to" headers.
• Reverse tabnabbing
• Clickjacking without proven impact/unrealistic user interaction
• CSV Injection
• Tokens leaked to third parties
• Anything related to email spoofing, SPF, DMARC or DKIM
• Not stripping metadata of files

Third Party Applications

We use third-party providers and services – including a number hosted on subdomains across our brand that will be considered Out of Scope for this program. We cannot authorize security testing against systems that do not belong to us, however we would encourage you to report any issues identified within these services to the third-party directly.
However, if you believe an issue with one of our third-party service providers is the result of Raidboxes' misconfiguration or insecure usage of that service, we would appreciate it greatly if you could share your finding.

General

• In case that a reported vulnerability was already known to us, will be flagged as a duplicate
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
• Spam, social engineering and physical intrusion
• DoS/DDoS attacks or brute force attacks (Application self DoS will be in scope)
• Reports that state that software is out of date/vulnerable without a proof-of-concept

This program follows Intigriti's triage standards.

Where can we get credentials for the app?

You can self-register on the application but please don’t forget to use your @intigriti.me address.