PROGRAM DESCRIPTION

.NET, ASP.NET, .NET Core, and ASP.NET Core are developer platforms for building different applications. The .NET Bounty Program invites researchers from across the globe to identify vulnerabilities in.NET, ASP.NET, .NET Core, and ASP.NET Core and share them with our team. Qualified submissions are eligible for bounty rewards from $500 to $15,000 USD.

This bounty program is subject to these terms and those outlined in the Microsoft Bounty Terms and Conditions and our bounty Safe Harbor policy.

IN SCOPE PRODUCTS AND SERVICES

Vulnerabilities submitted in the following products and services are eligible under this bounty program:

  • Current, supported*, RTM versions of Microsoft .NET 5 or later
  • Current, supported*, RTM versions of .NET Core and ASP.NET Core
  • Release candidates for upcoming versions of .NET
  • .NET 5 or later templates or .NET Core templates provided with a currently supported version of Visual Studio
  • Any associated documentation on docs.microsoft.com and samples contained within such documentation for current, supported*, RTM versions of .NET 5.0 or later, .NET Core, ASP.NET Core
  • Any Preview Features listed in this GitHub page, whether in current supported versions or an upcoming version.

*more information on the supported versions can be found here.

ELIGIBLE SUBMISSIONS

The goal of the Microsoft Bug Bounty program is to uncover significant vulnerabilities that have a direct and demonstrable impact on the security of our customers. Vulnerability submissions must meet the following criteria to be eligible for bounty awards:

  • Identify a vulnerability that was not previously reported to, or otherwise known by, Microsoft.
  • Such vulnerability must reproduce in one of the in-scope products or services 
  • Include clear, concise, and reproducible steps, either in writing or in video format.
    • Provide our engineers the information necessary to quickly reproduce, understand, and fix the issue.

Microsoft may accept or reject any submission at our sole discretion that we determine does not meet the above criteria.

GETTING STARTED

To get started, you can install .NET and .NET Core.The source is available from Github. Follow the .NET Blog to learn about the latest features and releases.

BOUNTY AWARDS?

Bounty awards range from $500 up to $15,000. Higher awards are possible, at Microsoft’s sole discretion, based on the severity and impact of the vulnerability and the quality of the submission. Researchers who provide submissions that do not qualify for bounty awards may still be eligible for public acknowledgment if their submission leads to a vulnerability fix. 
Vulnerability Type
Functioning Exploit
Report Quality

Award
Remote Code Execution
Required
High
Up to $15,000
No
High
Up to $6,000
No
 Low Up to $1,500
Security Design Flaw

Required
High
Up to $10,000
Optional
High
Up to $5,000
No
 Low Up to $1,500
Elevation of Privilege
Required
 High Up to $10,000
No
 Low Up to $5,000
Remote DoS
Optional
 High Up to $5,000
No
 Low Up to $2,500
Tampering / Spoofing
Optional
 High Up to $5,000
No
 Low Up to $2,500
Information Leaks
Optional
 High Up to $2,500
No
 Low Up to $750
Template CSRF or XSS
Optional
 High Up to $2,000
Optional
Low
$500
Documentation or samples included in documentation are insecure or encourage insecurity and are not described as samples which do not take security into consideration
Optional
High
Up to $1,000
Optional
Low
Up to $500

OUT OF SCOPE SUBMISSIONS AND VULNERABILITIES

Microsoft is happy to receive and review every submission on a case-by-case basis, but some submission and vulnerability types may not qualify for bounty reward. Here are some of the common low-severity or out of scope issues that typically do not earn bounty rewards:  

  • Publicly-disclosed vulnerabilities which are already known to Microsoft and the wider security community
  • Vulnerabilities in the .NET Framework, or any ASP.NET framework running on .NET Framework (Webforms or MVC).
  • Vulnerabilities in out of support versions of .NET or .NET Core.
  • Vulnerabilities in versions of .NET 5 or later, .NET Core or ASP.NET Core which are daily builds, early beta releases, or are not RTM or RC versions.
  • Vulnerabilities in user-generated content
  • Vulnerabilities requiring extensive or unlikely user actions
  • Vulnerabilities which disable or do not use any built in mitigation mechanisms
  • Low impact CSRF bugs
  • Server-side information disclosure
  • Vulnerabilities in platform technologies that are not unique to .NET, .NET Core or ASP.NET (for example IIS, OpenSSL etc.)
  • Sub-domain takeover

We reserve the right to reject any submission that we determine, in our sole discretion, falls into any of these categories of vulnerabilities even if otherwise eligible for a bounty.

ADDITIONAL INFORMATION

For additional information, please see our FAQ. 

  • If we receive multiple bug reports for the same issue from different parties, the bounty will be granted to the first submission.
  • If a duplicate report provides us new information that was previously unknown to Microsoft, we may award a differential to the duplicate submission. 
  • If a submission is potentially eligible for multiple bounty programs, you will receive the single highest payout award from a single bounty program.
  • Microsoft reserves the right to reject any submission at our sole discretion that we determine does not meet these criteria.

Thank you for participating in the Microsoft Bug Bounty Program!

REVISION HISTORY

  • October 20, 2015: Announced the new bounty program for .NET Core CLR and ASP.NET 5 Betas shipping with Visual Studio 2015.
  • January 20, 2016: Program concluded
  • June 7, 2016: Announced new bounty program covering both Release, and Release Candidate (RC) versions of .NET Core and ASP.NET Core
  • October 16, 2018: Updated to include Github links to source
  • November 20, 2020: Updated to use new nomenclature for .NET 5 and .NET Core
  • November 23, 2021: Added Preview Feature to scope