Version: 1.4 | Date: 17th Mar 2020
We are truly grateful for our customers, security researchers, and community users for responsibly reporting security vulnerabilities to us. Your efforts help us make our products (e.g. WSO2 API Manager), services (e.g. WSO2 API Cloud), and open source projects (e.g. Siddhi) more secure, and thereby helps protect the entire WSO2 user community.
When reporting security vulnerabilities, you need to adhere to a few guidelines. This document highlights the points that need to be considered before reporting a vulnerability, the process of disclosing a vulnerability, and the content that needs to be included in a vulnerability report.
Some of the vulnerabilities that you come across in the products that were downloaded from wso2.com might have already been fixed. For more information on the security advisories issued publicly by WSO2, see Security Advisories page.
Prerequisites for reporting Vulnerabilities
For WSO2 products, please make sure to go through the prerequisites before you run an automated security scan or perform a penetration test against them.
- Security aspects of the product are hardened
Make sure to follow the guidelines provided under Security Guidelines for Production Deployment. These guidelines might mitigate the security concerns you are experiencing.
- If you are a WSO2 subscription holder, ensure that you have installed all the Security updates.
- If you are a security researcher, we encourage you to download the latest product version available before testing.
Responsible Disclosure of Vulnerabilities
Based on the ethics of responsible disclosure, it is recommended to follow the process given below to report security vulnerabilities.
- If you are an independent security researcher or a community user, you must only use the firstname.lastname@example.org mailing list.
- If you are a customer of WSO2, you can either use the email@example.com mailing list or open a ticket in the Support Portal.
firstname.lastname@example.org is a highly confidential internal mailing list that is only visible to a selected group within WSO2. This includes the Platform Security Team members, Security Champions of product, service, and open source project teams, and people who hold leadership roles within WSO2. All the vulnerability reports are treated with the highest priority and confidentiality.
If you wish to send secure messages to email@example.com, you may use the following key:
Apart from the channels mentioned above, please do not use any other medium to report security vulnerabilities of WSO2. This includes, but is not limited to, repositories like GitHub, public forums, blogs and other websites, social media, and public and private chat groups.
Further, kindly refrain from sharing the vulnerability details you come across with other individuals. The vulnerability can only be publicized after we complete the mitigation actions. We will work closely with the reporter and will keep him/her updated on our progress.
What Constitutes a Proper Vulnerability Report
Please use the following template when reporting vulnerabilities so that it contains all the required information and helps expedite the analysis and mitigation process.
- Name of the vulnerable WSO2 product, project, or service and its version (if applicable).
- A high-level overview of the issue.
- Steps to reproduce. Feel free to send us a screen cast.
- Self-assessed severity and impact.
- Any proposed solution.
Vulnerability Handling Process
An overview of the vulnerability handling process:
- The user reports the vulnerability privately to firstname.lastname@example.org or through the Support Portal. The initial response time is less than 24 hours.
- The relavant team at WSO2 fixes the vulnerability and QA verifies the solution.
- The fix is distributed:
- If the issue is of a product, distribute the patches to the subscription customers first. Then disclose it publicly after 4 weeks.
- If the issue is of a service, apply the fix to the deployment.
- If the issue is of an open source project, apply the fix to the master branch, and release a new version of the distribution if required.
- Reported user is kept updated on the progress of the process.