Tencent Bug Bounty Program
Tencent looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe. If you believe you have discovered a vulnerability, kindly disclose to us responsibly via the Tencent Security Response Centre (TSRC).
Important: Report submitted directly though the platform YesWeHack will not be reviewed. They will be closed automatically as “RTFS”
The classification of a vulnerability (Critical, High, Moderate or Low as described below), whether a product or application is in scope of the bounty program and its classification (core, important, and other in-scope), and whether to grant a monetary reward and its amount will be within the sole discretion of the Tencent Security Team, based on a number of factors including, without limitation, quality of the report, severity of the vulnerability, reproducibility of the vulnerability, its impact on our users and other products and services, ease of exploitation and many other factors.
Any design or implementation issue that is reproducible and substantially affects the security of Tencent users is likely to be in scope for the program.
However, only reports that meet the following requirements are eligible to receive a monetary reward:
Products, services and applications distributed and made available in any form by or on behalf of Tencent and described in “Core Products” and “Other In-Scope Products” below are in scope. For more information about our products and services, please visit https://www.tencent.com/en-us/business.html
It includes the majority of Tencent's products and businesses, such as Tencent Game Helper (腾讯游戏助手), Tencent Ride Code Mini Program(腾讯乘车码小程序), QQ Music and other products, including but not limited to mobile applications, clients, mini programs, web sites, hardware, IoT, server services, and other product models.
Only vulnerabilities affecting the platform itself and IP owned by Tencent will be accepted. If an IP belongs to Tencent Cloud external customer, it is not considered in scope.
Please note that the vulnerabilities reported for the following assets will not be eligible for bounties.
| Scope | Critical Severity Vulnerability | High Severity Vulnerability | Moderate Severity Vulnerability | Low Severity Vulnerability |
|---|---|---|---|---|
| Core assets | $1,865-6,425 | $585-780 | $75-130 | $15-32 |
| Other in-scope assets | $1,225-1,827 | $390-520 | $40-65 | $8-17 |
Rewards are stated in USD.
| Severity Rating | Example |
|---|---|
| Critical | Vulnerabilities that directly obtain permissions (limited to Tencent's server permissions and core product client permissions). This includes but is not limited to remote arbitrary command execution, uploading webshells, etc. |
| Vulnerabilities that directly lead to serious information leakage, limited to platforms such as WeChat, QQ, QZone, King of Glory, and platforms of the same scale, involving information that can affect the security of user identity information. | |
| Logical vulnerabilities that directly cause serious impact. This includes but is not limited to sending messages to other users via spoofed QQ/WeChat account, and vulnerabilities that permit resetting passwords of other user's QQ/WeChat account. If the vulnerability can only pop up harassment and cannot specify readable content, it is not applicable to be classified as a critical vulnerability. | |
| Vulnerabilities that directly affects cash. It must meet the conditions of direct withdrawal without utilization restrictions, and the affected amount exceeds RMB100,000. | |
| High | Vulnerabilities that can directly steal user identity information. This includes stored XSS (little interaction and easy to spread, can affect a large number of users) in QZone, QQ Mail, WeCom Mail, Web WeChat, and WeChat Official Account products, and SQL injection vulnerabilities that can read database table field names on Tencent business sites. |
| Vulnerabilities allowing unauthorized access to the management platform and use of administrator functions, including sensitive management back end login; the number of active users, number of users (with no less than a thousand users), functional importance, and sensitivity of user information on related platforms will be used as the rating criteria for high-risk vulnerabilities. | |
| High-risk information leakage vulnerabilities. This includes directly exploitable sensitive data leaks, vulnerabilities that can cause a large number of user identity information leaks on the site or directly pose high risk to business. It leaks at least three sensitive information fields, affecting more than 10,000 users; If not met, the rating will be evaluated according to the actual situation (sensitive information fields refer to real name, ID card number, address, contact information (mobile phone, WeChat, QQ), bank card number, complete transaction information, medical information, etc.). | |
| Vulnerabilities that can directly obtain client permissions remotely. This includes remote command execution, exploitable remote buffer overflow, exploitable browser use-after-free vulnerabilities, remote kernel code execution vulnerabilities, and other remote code vulnerabilities caused by logical problems. | |
| SSRF vulnerabilities that can directly access Tencent's intranet and fully echo (it needs to be proved that the vulnerability point can indeed access the intranet, and no scanning of intranet services is allowed. In addition, SSRF is uniformly scored according to the key business. | |
| XSS in core client products that can obtain sensitive information or perform sensitive operations. | |
| Unauthorized use of other people's identities to perform all functions. | |
| Beyond business and product expectations, a single user can arbitrarily obtain virtual goods with cash value, affecting at least RMB5,000. | |
| Arbitrary file read and write vulnerabilities, including COS arbitrary file read and write and overwrite vulnerabilities that can be performed on the entire site used by the business | |
| Moderate | Vulnerabilities that require interaction to obtain user identity information. This includes but is not limited to stored XSS, reflected XSS, DOM-XSS, and CSRF for important sensitive operations. |
| Remote application denial of service vulnerabilities (without interaction), kernel denial of service vulnerabilities, and XSS in client products that can obtain sensitive information or perform sensitive operations. | |
| Ordinary information leakage vulnerabilities. This includes plaintext storage of passwords on the client, plaintext transmission of QQ passwords, and leakage of source code compression packages containing sensitive information. | |
| Subdomain hijacking of qq.com and tencent.com. | |
| OAuth login or binding hijacking that requires clicking on a link to interact. | |
| SSRF vulnerabilities that can directly access Tencent's intranet but have no echo. | |
| Arbitrary code execution on the local machine. | |
| The leakage of WeChat mini program‘s key , if unable to prove that partially harmful APIs can be exploited, such as sending customer service messages, calling Tencent Cloud API write operations, etc., the rating will not exceed [Moderate]. | |
| Non-critical single interface authorization vulnerabilities will not exceed [moderate]. | |
| Low | Vulnerabilities that can only obtain user identity information in specific non-popular browser environments. |
| Vulnerabilities that result in leakage of small amount of low-impact information. | |
| URL redirection. | |
| Unrestricted SMS bombing vulnerability. | |
| Issues that are difficult to exploit but may have security risks. |
All reports will be reviewed based on the impact and severity of the reported vulnerability. Any qualifying report that results in a change being made will at a minimum receive the Hall of Fame recognition.
The main categories of vulnerabilities that we are concerned about are:
You can use a QQ or Wechat account to log into all Tencent’s assets.
To register a QQ account, please go to https://ssl.zc.qq.com/v3/index-en.html?type=0 and follow the instructions.
To register a Wechat account, please download an WeChat app from App store or through Android system, then follow the registration guide.
Once you have a QQ or WeChat account, you can start testing.
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope (either ineligible or false positives):
We have set up a "demo" service for SSRF testing. If you believe you have an SSRF in production, please use either of the following IP/port combinations for testing:
http://10.204.9.230:80 aka http://tst.qq.com/flag.html
This service will accept HTTP requests to any endpoint, of any request type, and will return a secret token in both headers and response body.
| Scope Type | Scope Name |
|---|---|
| web_application | In-Scope Products (for the full list please visit https://en.security.tencent.com/index.php/policy) |
| Scope Type | Scope Name |
|---|---|
| undefined | Please note that the vulnerabilities reported for the following assets will not be eligible for bounties. |
| undefined | Notes about Tencent Cloud (cloud.tencent.com as included in .tencent.com) |
| undefined | Only vulnerabilities affecting the platform itself and IP owned by Tencent will be accepted. If an IP belongs to Tencent Cloud external customer, it is not considered in scope. |
| web_application | *.qzoneapp.com |
| web_application | *. myqcloud.com |
| web_application | Third-party applications and websites |
This program crawled on the 2023-04-26 is sorted as bounty.
FireBounty © 2015-2025
