Should I report a security vulnerability?

Question

I scanned a site using a vulnerability scanner and it found a vulnerability with a CVV score of 10. Should I send the report to the company?

Answer 1

Quick note: this answer assumes that you have permission to run scanners against the website. Running scanners against a website is illegal in basically all jurisdictions, so if you are doing that then my only suggestion is: "STOP!".

What you shouldn't do

You should never send a vulnerability report from a scanner to a company. 90% of the time those are useless by themselves, and are likely to be ignored by any competent security team. The reason is because scanners can have any number of false positives, so a positive from a vulnerability scanner does not actually mean there is a vulnerability. However, it is common for new bug bounty testers to simply send vulnerability reports from scanners off to companies without any understanding of what the report says, if it is correct, or if it is even applicable. As a result security teams will often just ignore a report that came straight out of a scanner. Most bug bounty programs specifically state this.

What you should do

Instead you should take the time to generate a vulnerability report yourself, which means that you describe the nature of the vulnerability, steps they can take to confirm your findings, the risk the vulnerability creates for the company, and potentially even steps they can take to mitigate the danger. That is what you should send to the company, and sending something like that is almost always a good idea.

If this is a company that doesn't have a public bug bounty program then they are even less likely to be able to make sense of a report out of a scanner, so it will be that much more important for you to take the time and provide an actually vulnerability report detailing the vulnerability, the impact to the business, an estimate of its severity, and suggested mitigation steps. Obviously though that's not the situation you are in, since running automated security scans on a website without explicit approval is illegal in most jurisdictions and a bad idea in general...

tl/dr:

Should you send the results from your scanner to a company? No, because that's often useless. What you should do is verify that the scanner isn't reporting a false positive and then send a report detailing the vulnerability, what they can do to reproduce it, an explanation of its impact, and suggested mitigation steps. You obviously shouldn't "hack" into the system under any circumstances.

Answer 2

Rule one of vulnerability scanning or any other activity that could possibly be interpreted as hostile: get permission in writing signed by senior management first. An unsolicited "vulnerability scan" is indistinguishable from a hacking attempt - and if you used a common tool, and they have any smart monitoring going on, they will have detected that scan, and logged your IP address. And a poorly-worded report of a vulnerability you have found is indistinguishable from a threat. If you're lucky, the existence of a common bug in their site might mean they don't have good monitoring. However such a company is more likely to call the police if they think, however incorrectly, that you are threatening to hack them.

Consider it this way: a random stranger one day tells you that you left your windows unlocked. He or she swears that they didn't go into your house. Would you be grateful or would you wonder why this person was trying your windows?

It is sad to say but this is the reality of the world today - your most sensible option is to do nothing. Consider that you have learned something about vulnerability scanning today, and move on.

Answer 3

Do you want to be a white-hat or black-hat? The answer may also depend on what laws apply based on what country you are in, what country the company is in.

Things that are always ok

Use a responsible disclosure process to disclose the finding to the company.

See if the company has a vulnerability reporting process. A good place to start is seeing if they have a https://company.com/.well-known/security.txt. If not then search around and see if they have a security email address for reporting things like this.

Another option if you can't or don't want to deal with the company directly is to report through a middle-man like US Cert.

It should also be stated here that if you want the company to take you seriously, you need to clearly describe the issue, steps to reproduce, describe how pervasive it is in their application, what damage and attacker could cause with it, and what they should do to fix it. If you just send them the report from a scanner, they will likely ignore you, or worse send a lawyer after you (see below).

Things that are sometimes ok

Sometimes it's ok to publish the result without informing the company (for example by filing a CVE, or writing a blog post, github repo).

Depending on the type and severity of the vulnerability, this could end up doing more damage than good if people get hacked before the company has time to fix it.

"Things that are sometimes ok" could include running the scanner in the first place. Unless you are hired to do that or there's a bug bounty program, it could be interpreted as a hacking attempt. (Thanks @EsaJokinen). A quick google-search shows that when you do "security research" without permission you're just as likely get lead to jail time, as to get a thank you:

• Feds Expand Security Researchers' Ability to Hack Without Going to Jail
• Security researcher arrested for disclosing US election website vulnerabilities
• Arrested security researcher’s case takes a turn
• When cybersecurity research leads to jail time
• Protect the White Hat Hackers Who Are Just Doing Their Jobs

Hitting someone else's website with a security scanner can land you in big trouble, so make sure you understand the legal implications before you do it!

Things that are never ok

Hacking the website yourself.

This is undoubtedly illegal in every country that has laws about this.

Be very careful taking this approach because you can lose a lot, and I'm not sure you gain anything (at least from a white-hat perspective).