Upwork Bug Bounty Treasure Map

Upwork’s security team has designed a bug bounty program to help researchers help us track down vulnerabilities and other critical issues. As this is a priority for Upwork, the Upwork Bug Bounty Program offers cash rewards to encourage security researchers to keep us informed on security findings related to our various services.

As some researchers may be reluctant to search for bugs on bug bounty programs due to not having the right direction on how to get started, we have assembled a treasure map to help researchers get started.

Upwork’s treasure map

Our distributed system consists of multiple parts assembled to what you know as Upwork. The following “treasure map” is a list of our most critical public services and tips on hunting for any vulnerabilities or bugs. It all starts with our main website app at upwork.com.

www.upwork.com

Summary: This site is the main web application that connects businesses with independent talent and agencies around the globe. Upwork.com is the world’s work marketplace, fostering a collaborative environment where independent talent work with clients in new and innovative ways. 

Technology: The following are some of the many technologies used:

• Vue.js
• jQuery
• Angular
• Modernizr
• NGINX
• Webflow
• Cloudflare CDN
• Amazon CloudFront
• Fastly
• Mailgun
• AWS
• Nodejs 9

upwork.com/api 

Overview: The Upwork API can be used to build applications that integrate Upwork features and workflow into dashboards, the website, and management systems. Developers seeking to use Upwork’s API must comply with our API Terms of Use.

Technology: The Upwork API runs on PHP, GraphQL, and Java. To access the API, developers can use Python, PHP, Java, Ruby, Node, Perl or Go language. More details on how to apply for API keys and using the API are available at developers.upwork.com. 

What to look for: The Upwork API is the entry point for RESTful API and other access control. We are specifically interested in the following:

• Vulnerabilities that can lead to account takeovers for client and/or freelancer accounts
• Vulnerabilities in the OAuth flow

api.upwork.com/graphql

Overview: The Upwork API’s GraphQL instance. This endpoint provides the services for accepting job offers, logging into an account, or viewing job postings. 

Technology: GraphQL

What to look for: We are interested in application and business logic issues, Insecure Direct Object References (IDORs), remote code execution vulnerabilities, and Cross-Site Scripting (XSS) vulnerabilities which may lead to sensitive information disclosure.

Mobile applications

Overview: Upwork provides mobile applications for download on Google Play and Apple App Store. These apps contain features found on Upwork’s website and are available as two distinct apps:

• Upwork for Freelancer
• Upwork for Client

Technology: Java classes on Kotlin.

What to look for: Upwork is interested in mobile security issues, hardcoded intents/credentials to sensitive information disclosure, and XSS vulnerabilities.

Desktop application (Dash Messenger)

Overview: The Upwork desktop app is designed for easy collaboration, time tracking, and messaging on the Upwork platform. Freelancers can also use it to log time on hourly contracts. The desktop app is currently available for Windows, Linux and macOS.

Technology: Node.js, Electron

What to look for: We are primarily concerned with code injection, access control issues, and hard-coded credentials. These vulnerabilities could lead to remote code execution on user devices. 

To get started

For more information, researchers can submit a report to us using our bug bounty program bugcrowd.com/upwork. If you believe you’ve found a security vulnerability or other defect in our service, we’ll gladly work with you to resolve that issue.

Google Play and the Google Play logo are trademarks of Google LLC. Apple and the Apple logo are trademarks of Apple Inc. and the App Store is a service mark of Apple Inc.