Responsible Disclosure Program (VDPBW) 2021

One year has now passed since the Bundeswehr made public the first vulnerability disclosure policy (vdpbw) for a responsible disclosure program. Since our security researchers always like to be the first to test and actively participate in a bug bounty or responsible disclosure program, we naturally started this time as well.

Many security researchers from all over germany and even the eu participated in the program. Approximately 100 valid security vulnerabilities were submitted. The bundeswehr is already talking about a great success of the "VDPBW" program. One security researcher from the vulnerability-lab team, whom we all know particularly well as the usual suspect "Benjamin Mejri (Kunz)", has once again hit the bell of success.

A vulnerability researcher of the vulnerability lab team disclosed a simple but effective technique that was used against microsoft and adobe some years ago. A persistent input validation web vulnerability has been discovered in the official BMW online service portal web-application.

The vulnerability is located in the `firstname` and `lastname` value parameters of the `mail` module. The vulnerable parameters are insecure sanitized next to being delivered inside of a basic html mail template.