Visma delivers software that simplifies and digitizes core business processes in the private and public sector. With presence across the entire Nordic region along with Benelux, Central and Eastern Europe, we are one of Europe’s leading software companies. We want to engage with responsible security researchers around the globe to further secure our services. No code is flawless and we believe that taking part in the Intigriti community can help us improve the security of our systems.
In order to gain a positive relationship and avoid misinterpretation and vagueness, we would like you to review the following program rules before you report a vulnerability. By participating in this program, you agree to respect our policy.
In connection with your participation in this program you agree to comply with all applicable local and national laws.
You may not participate in this program if you are currently employed or contracted by Visma.
You may not participate in this program if you are a resident or individual located within a country appearing on any U.S. or E.U. sanctions list.
Vulnerabilities obtained by exploiting Visma users or employees are not eligible for a bounty and will result in immediate disqualification from the program.
Visma has never given permission/authorization (either implied or explicit) to an individual or group of individuals to extract personal information or content of Visma's customers and publicize this information on the open, public-facing Internet without customer consent, nor has Visma ever given permission for programs or data belonging to Visma to be modified or corrupted in order to extract and publicly disclose data belonging to Visma.
Visma reserves the right to change this policy at any time. You can subscribe to program updates to be notified of any changes.
Visma Scanner
Visma Scanner is a mobile app used for sending receipts and invoices to your Visma accounting system.
The iOS version of the app can be found here:
https://apps.apple.com/us/app/visma-scanner/id564141518
Please read and follow the steps in the Startup guide to create an account and start hacking: https://vismabugbountyprod.z16.web.core.windows.net/VismaScanner-iMXxOpXkhOlTBUQtXfyA-getting-started.pdf
Out of scope:
Connect
See instructions for domain "connect.identity.stagaws.visma.com".
Out of scope:
Visma Online
This is the old interface for the customer's administrators to administrate the company, where we still have some functionality that has not been moved to the new interface. For example invoicing information and everything regarding collaborations with AO. The collaboration part is out of scope as long as the use of student companies.
Please read the Getting Started Instructions in the "myservices.stage.vismaonline.com" asset description.
Out of scope:
AutoInvoice
This is the main UI for Visma AutoInvoice. AutoInvoice is Visma's automated and fully ERP integrated service for sending, receiving and handling invoices. AutoInvoice converts and exchanges electronic invoices, optionally prints invoices that can't be sent electronically, receives and interpret PDF invoices and offers services for scanning and interpretation of paper invoices. AutoInvoice handles both Business to Business (B2B) and Business to Consumer (B2C) invoices.
Uses partially the embeddable user interface from autointerface-embeddable-stage.maventa.com
Create a test account on https://ai-testing.maventa.com/registrations, or use one of the demo accounts in the getting started instructions below:
https://vismabugbountyprod.z16.web.core.windows.net/VismaAutoinvoice-tHNjPCTbrmGiPY5y0xr8-getting-started.pdf
Out of scope or works as expected (accepted risk):
Note! ai-testing.maventa.com and testing.maventa.com point to the same application but have different branding on the UI. Authentication to the user interface is handled using the Visma Connect service.
AI Assistant
The AI Assistant is a AI bot that answers support questions based on public product documentation for Visma Spcs products like Visma eAccounting and Visma Advisor.
You need to register an user to test this system. The sign-up up process is described in this document:
This video also shows the entire setup (only Swedish audio) https://www.youtube.com/watch?v=kVr_CXgfhi0&t=4s
TLDR: Goto https://admin.stage.vismaonline.com/Customer/StudentSignup.aspx and sign up with the training code "04h2v"
Out of Scope
Dinero
This is Dinero's Public API.See instructions for "app.workbox.dk"
Dinero
Dinero is an accounting software for sole traders and micro businesses based out of Denmark. Our only target group is danish companies and therefore the interface is in danish only. The application is a SaaS application hosted in the cloud and consists of a main application and a number of supportive microservices.
See the getting started document here: https://vismabugbountyprod.z16.web.core.windows.net/VismaDinero-37UeRwujIXh7r9n3Wol6-getting-started.pdf
Out of scope:
Dinero
Used for Authorization (OAuth). See instructions for "app.workbox.dk"
AutoInvoice
See instructions for domain 'ai-testing.maventa.com' to get user credentials.
The same resource can be accessed through the URL autointerface-embeddable-stage.maventa.com
All data processing is done through the REST API at ax-stage.maventa.com
Out of scope or works as expected (accepted risk):
AutoInvoice
https://ax-stage.maventa.com is a REST API connected to Visma AutoInvoice.
API documentation is available on https://documentation.maventa.com/rest-api/ and https://ax-stage.maventa.com/swagger/#/
See instructions for domain 'ai-testing.maventa.com' to get user credentials.
Out of scope or works as expected (accepted risk):
Visma Scanner
Visma Scanner is a mobile app used for sending receipts and invoices to your Visma accounting system.
The Andriod version of the app can be found here:
https://play.google.com/store/apps/details?id=com.visma.blue&hl=en
Please read and follow the steps in the Startup guide to create an account and start hacking: https://vismabugbountyprod.z16.web.core.windows.net/VismaScanner-iMXxOpXkhOlTBUQtXfyA-getting-started.pdf
Out of scope:
Connect
Visma Connect is featurewise a small but critical component in the Visma portfolio. It is a single sign-on solution used by many Visma services. It is also the place where users manage security preferences such as passwords, MFA, 2FA, email and other account settings.
User accounts for testing can be created on https://connect.identity.stagaws.visma.com (this signup flow is not available in production).
The test accounts will not have access to any other services right now, so testing is limited to the login portal itself.
Out of scope:
eAccounting
This is "Visma eAccounting" (aka Visma eEkonomi / Visma ePasseli) which is an ERP system available in Sweden, Norway, Finland and The Netherlands.
We've added into scope also the eEkonomi "Visma Lön Smart" which is a subservice of eAccounting. This can be found after you activate your account (check out the instructions bellow).
You can read more on https://www.visma.no/eaccounting/english/
You need to register an user to test this system. The sign-up up process is described in this document:
https://vismabugbountyprod.z16.web.core.windows.net/Visma-eAccounting-1GWFyEopW9dTKsGYM3FJ-getting-started.pdf
This video also shows the entire setup (only Swedish audio) https://www.youtube.com/watch?v=kVr_CXgfhi0&t=4s
TLDR: Goto https://admin.stage.vismaonline.com/Customer/StudentSignup.aspx and sign up with the training code "04h2v"
Out of scope:
Session invalidation issues (e.g. logout, password change, email change, role change, user deletion, etc).
Modification of gray-out fields when logged in with an admin account.
Improper access control: manipulation of the message conversation by members that have no permission (edit subject, join thread conversation, closing the conversation).
Email phishing
PDF injection
Permissions for Lön Smart (the permissions in eAccounting don´t apply at all for Lön Smart).
Possibility to create Orders and Quotes with amount 0€
Race Condition in article stock limits
We plan to fix all server-side validation for all tabs mentioned below. All these are under Lön Smart in eAccounting. So until all fixes are applied the following will remain out of scope:
eAccounting
You reach this asset by creating and viewing a report under the Accounting/Reports menu as a logged on user in asset "eaccounting.stage.vismaonline.com"
Visma Online
Visma Connect is used as identity provider, but an own identity server is used to provide JWT tokens that are used by MyServices (and others).
Please read the Getting Started instructions document in the "myservices.stage.vismaonline.com" asset description.
Out of scope:
Visma Online
This is the API behind "myservices.stage.vismaonline.com".
Please read the Getting Started instructions document in the asset description "myservices.stage.vismaonline.com".
Visma Online
This is an interface where the customer's users can access all their services, and customer's administrators can manage users on the company and manage users' access to services that the company has.
More information about the service and test accounts creation can be found here:
https://vismabugbountyprod.z16.web.core.windows.net/VismaOnline-9Jn9Xh382zaQsQ8IqT2x-getting-started.pdf
Out of scope:
Visma Developer Portal
Visma Developer Portal is used both internally and externally by developers for registering OAuth 2.0/OpenID Connect applications for Single-Sign-On with Visma (Visma Connect) and/or API integration.
Existing Visma Connect users accounts can be used for testing. We also allow registration of new users if needed.
Users need to register an organization as part of the sign-in or to be added (invite) to an existing organization by organization's manager. The user which registers the organization also gets manager role assigned.
Each organization has its own set of OAuth 2.0/OpenID Connect applications.
Please read the Getting Started Instructions here: https://vismabugbountyprod.z16.web.core.windows.net/VismaDeveloperPortal-Ze8WD6GFaIFdLvE2ekbN-getting-started.pdf
Out of scope:
AutoInvoice
https://testing.maventa.com/apis/v1.1/wsdl is a SOAP API connected to Visma AutoInvoice.
API documentation is available on https://documentation.maventa.com/soap-api/
See instructions for domain 'ai-testing.maventa.com' to get user credentials.
**Thank you all for this year dear colleagues and hackers! We’ve had an epic year with almost 2600 vulnerabilities reported (last 365 days), of which 96 reports were exceptional or critical, wow!
Big thanks to all of our amazing hackers doing an incredible job making Visma more secure! From the bottom of our hearts, we appreciate you.
With that said, it is time for us to gear up for the holiday season and take some rest from this hectic year, with that, we will suspend this program soon for the remainder of the year and be back next year stronger than ever!
Enjoy the holiday season and see you next year,
With love, Visma Security Team**
We are happy to announce the launch of our Public Bug Bounty Program on Intigriti, so if you have discovered a security vulnerability, please inform us through this program and we will do our best to quickly fix it.
Only the assets explicitly listed above are eligible for monetary rewards.
Vulnerabilities in any other Visma service, product or web property can be reported to our Visma Responsible Disclosure program, but those reports do not qualify for this Bug Bounty Program.
We plan to continuously update our scope, so keep an eye on us or subscribe to our program to receive updates.
Additionally to the bellow general out of scopes, please make sure you always check the asset description under each domain and don't submit issues that are out of scope for those specific domains.
In general, please do not submit issues regarding:
No impact means no bounty. We will always take into consideration the business impact and security impact when setting the final severity of the reports.
Monetary rewards will be offered for qualifying reports. The amount will vary depending on the severity. The "Bounties" section provides a general guideline for the amounts, but final rewards may be adjusted for actual business impact. For example an SQLi for a database containing no sensitive information may be rewarded a lower amount compared to an SQLi for a database with sensitive information.
We highly value good quality, actionable reports and that’s one of the the requirements for "Exceptional" severity category.
When duplicates occur, we will only accept the first report. A duplicate is a vulnerability that we are already aware of, regardless of how we first became aware of it (it could have also been discovered by us internally).
To get an idea of how we define severities, see the following table as a guideline:
| Severity | Vulnerability |
|---|---|
| Exceptional | A quality report that shows exceptional impact to Visma and it's customers, typically otherwise in high or critical severity category |
| Critical | Remote Code Execution (RCE) |
| Critical | SQL Injection (SQLi) |
| Critical | Authentication or Authorization Bypass |
| High | Local File Inclusion |
| High | Account Takeover |
| High | Mass PII Extraction |
| High | Horizontal Privilege Escalation across customer contexts |
| High | Vertical Privilege Escalation |
| High | XML External Entity Injection (XXE) |
| Medium | Insecure Direct Object Reference (IDOR) |
| Medium | Horizontal Privilege Escalation within the same customer context |
| Medium | Server-Side Request Forgery (SSRF) |
| Medium | Reflected Cross-Site Scripting |
| Medium | Stored Cross-Site Scripting (XSS) |
| Medium | DOM-based Cross-Site Scripting |
| Medium | Cross-Site Request Forgery (CSRF) |
| Medium | Sensitive Data Exposure |
| Medium | Cross-Site Script Inclusion (XSSI) |
| Low | GUID-based IDOR |
| Low | Mass User Enumeration (without brute-forcing) |
| Low | Clear text Submission of Passwords (over HTTP) |
| Low | Open Redirect |
| Low | HTML content injection |
| Low | Broken Link Hijacking |
| Low | PHP Info Disclosure |
| Low | Rate limit issues on authentication endpoints |
| Informative | Non-State Changing Cross-Site Request Forgery |
| Informative | CSV/formula injection |
| Informative | Server Information Page |
| Informative | User Enumeration including WordPress Mass User Enumeration |
| Out of scope | Text (non-html) content injection |
| Out of scope | Non-Sensitive Data Disclosure |
| Out of scope | Lack of, or weak, security headers |
| Out of scope | Flash based CSRF |
| Out of scope | DoS & DDoS |
You can self-register on the application, but please don’t forget to use your @intigriti.me address. For more details, please read each asset description.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
