RESEARCHER SIGN UP LOGIN OUTHACK THEM ALL™ Who We Are Products Resources Customers CrowdStream Programs About Learn More Western Union Moving money for better $100 – $3,000 per vulnerability Partial safe harbor Submit report Program details Announcements 11 Hall of Fame Program stats 423 vulnerabilities rewarded Validation within 3 days 75% of submissions are accepted or rejected within 3 days $1,191.66 average payout (last 3 months) Latest hall of famers View all 863 Recently joined this program 2089 total Disclosure Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public. Western Union is a financial services and communications company based in the United States. In general, Western Union adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization of findings, but they do reserve the right to alter priority on a case-by-case basis. Any submission where the priority is altered will be accompanied by an explanation from the Western Union team. Note on special domains: The following transaction/core domains below will have higher rewards due to their sensitivity: https://www.westernunion.com https://ebanking.westernunionbank.com https://partnernet.westernunion.com Scope and rewards In Scope In scope Payment reward chart P1 $1500 – $3000 P2 $700 – $1500 P3 $300 – $700 P4 $100 – $200 https://www.westernunion.com Bootstrap jQuery RequireJS +4 https://www2.westernunion.com https://www.westernunion.fr Bootstrap Vue.js jQuery +4 https://www.westernunion.de Bootstrap Vue.js jQuery +4 https://www.westernunion.no https://www.westernunion.se https://www.westernunion.ca Bootstrap jQuery Zone.js +4 https://www.westernunion.nl https://www.westernunion.es https://www.westernunion.ie Bootstrap jQuery Angular +3 https://www.westernunion.ch Bootstrap jQuery Angular +3 https://www.westernunion.pt https://www.westernunion.be Bootstrap Adobe Experience Manager Vue.js +5 https://www.westernunion.dk https://www.westernunion.fi https://www.westernunion.pl Bootstrap Adobe Experience Manager Vue.js +5 https://www.westernunion.ee Bootstrap Adobe Experience Manager Vue.js +6 https://www.westernunion.lu Bootstrap Adobe Experience Manager Vue.js +6 https://www.westernunion.gr jQuery MySQL Wordpress +1 https://www.westernunion.at Bootstrap Adobe Experience Manager Vue.js +6 https://www.westernunion.it Bootstrap Adobe Experience Manager Vue.js +6 https://www.westernunion.co.nz Bootstrap Adobe Experience Manager Vue.js +6 https://www.westernunion.co.uk https://www.westernunion.com.au Bootstrap Adobe Experience Manager Vue.js +6 https://cuba.westernunion.com https://egypt.westernunion.com Bootstrap Adobe Experience Manager Vue.js +6 https://hk.westernunion.com https://india.westernunion.com Bootstrap Adobe Experience Manager Vue.js +6 https://jamaica.westernunion.com https://locations.westernunion.com jQuery nginx Scala +1 https://m.westernunion.com https://senegal.westernunion.com https://sg.westernunion.com Bootstrap Adobe Experience Manager Vue.js +5 https://wuagentportal.westernunion.com Website Testing jQuery Java https://agentportal.westernunion.com Website Testing jQuery Java https://westernunionbank.com Website Testing Bootstrap jQuery +1 https://ebanking.westernunionbank.com Website Testing jQuery PHP https://auth.globalpay.westernunion.com Website Testing Bootstrap ASP.NET +2 http://globalpay.westernunion.com Website Testing Windows Bootstrap +3 payee.globalpay.westernunion.com ASP.NET Windows Microsoft IIS +1 https://gpfi.globalpay.westernunion.com Akamai CDN Java Bootstrap +5 transvision.westernunion.com Website Testing partnernet.westernunion.com Adobe Experience Manager Java RequireJS +3 iwgo.westernunion.com Bootstrap Moment.js jQuery +3 https://business.westernunion.com/ Bootstrap Select2 ASP.NET +4 http://agenttraining.westernunion.com Bootstrap RequireJS jQuery +3 https://paymentstatus.westernunion.com Website Testing https://foundation.westernunion.com Akamai CDN Bootstrap Moment.js +6 https://partners.westernunion.com Akamai CDN Adobe Experience Manager Java +9 wucare.westernunion.com Bootstrap Moment.js Website Testing secure.westernunion.com ASP.NET Windows Microsoft IIS +1 corporate.westernunion.com Akamai CDN Modernizr jQuery +1 Western Union iOS app (link below) Mobile Application Testing iOS Objective-C +2 Western Union Android app (link below) Mobile Application Testing Android Java +1 www.wuedge.com Akamai CDN Java Bootstrap +3 trackpayments.westernunion.com Java Website Testing masspay.api.westernunion.com Website Testing wuinsights.westernunion.com Website Testing remoteaccess.westernunion.com Java jQuery Website Testing secureauth.westernunion.com ASP.NET Website Testing Out of scope targets Out of scope payments.westernunion.com Website Testing Any asset not listed above as 'In Scope' Website Testing https://rewardcircle.westernunion.com Website Testing www.wuprepaid.de Website Testing https://www.wuprepaid.at/ Website Testing https://onlinefx.westernunion.com/ Bootstrap Select2 ASP.NET +4 https://online.westernunion.com/mp.en/pages/loginform.aspx ASP.NET Windows jQuery +2 Any domain/property of Western Union not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to find an issue on a domain/property that is not listed above, please submit it to our kudos program: Here For this program, researchers are invited to test the production builds of the Western Union mobile app, both for Android and iOS, as well as the applicable API calls utilized by these applications. Researchers are free to self-provision accounts as needed - however, it's important to note that no testing credit cards or refunds for purchases can or will be provided by Western Union at this time - please be aware of this and either immediately cancel any orders, or only transfer small denominations of currency. Access: The production build of the iOS app can be downloaded here The production build of the Android app can be downloaded here API documentation (or at least a list of endpoints utilized by the mobile apps) is available here Please note that @bugcrowdninja.com email addresses may not work when registering for an account. In the case of this program, feel free to use your testing gmail, or whatever is most expedient for your testing purposes. Additional Information/Rules of Engagement: Assets in the scope above are variations on a core web application handling all requests, as such, security issues reproduced in one domain will be reproducible in other domains, making them a single core issue and only worth a single reward. Submissions of a P1-P2 rating must include a working attack scenario to be eligible for a reward. etc/passwd instead of web.inf for example. Focus Areas: Send Money / Track Transfer pages We are most interested in vulnerabilities on our core platform and infrastructure Ability to remotely gain access to other user's PCI Details (Credit card, CVV, etc) Ability to remotely gain access to other user's PII Details (First name, last name ,payment information’s , etc) Remote Code Execution Significant Authentication Bypass Exfiltration of Sensitive Data or PII or PCI or MTCN Remote Unauthorized Access to full WU database Out of Scope Do not perform DoS or DDoS attacks. Do not in any way attack our end users, or engage in the trade of stolen/breached user credentials. Do NOT conduct non-technical attacks such as social engineering, phishing or unauthorized access to Infrastructure. Do NOT use automated scanners and tools. The following finding types are specifically excluded from the bounty: 3rd Party Clients (e.g. WordPress). If you are unsure whether or not a client is 3rd party, please check with us. Re-posting of vendor notices for platform updates Login Page / Forgot Password Page Account Brute force or account lockout not enforced. Logout Cross-Site Request Forgery (logout CSRF) Program rules This program follows Bugcrowd’s standard disclosure terms. For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email support@bugcrowd.com. We will address your issue as soon as possible. This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT. WHO WE ARE Crowdsourced Security How it Works Meet the Crowd Program Management PRODUCT Bug Bounty Next-Gen Pen Test Vulnerability Disclosure Solution Comparison Platform Vulnerability Rating Taxonomy Jira + Bugcrowd RESOURCES For Companies Bugcrowd University For Researchers Events Forum Glossary CUSTOMERS ABOUT Blog Press Careers Partners Contact PROGRAMS BUG BOUNTY LIST JOIN THE CROWD Terms & Conditions Privacy Policy Do Not Sell My Information Copyright © 2021 Bugcrowd