Microsoft expands its bug bounty program for .NET and raises the maximum reward to $40,000 for certain bugs in .NET and ASP.NET Core.
The company stated that these changes reflect the actual complexity of finding and exploiting vulnerabilities related to .NET.
“We are pleased to announce significant updates to the Microsoft .NET bounty program. The changes expand the scope, simplify the reward structure, and offer great incentives for security professionals,” writes Madeline Eckert, Senior Program Manager of Security Researcher Incentives at Microsoft. “The program now offers up to $40,000 for vulnerabilities affecting .NET and ASP.NET Core (including Blazor and Aspire).”
Thus, Microsoft now pays:
- up to $40,000 for critical remote code execution and privilege escalation bugs;
- up to $30,000 for critical security feature bypasses;
- up to $20,000 for critical remote denial of service (DoS) attacks.
The bug bounty program has also been expanded to cover more issues in the .NET Framework. It now includes:
- all supported versions of .NET and ASP.NET;
- related technologies, such as F#;
- supported versions of ASP.NET Core for .NET Framework;
- templates provided with supported versions of .NET and ASP.NET Core;
- GitHub Actions in .NET and ASP.NET Core repositories.
As part of the restructured program, Microsoft will calculate rewards for vulnerabilities based on their potential impact, so that researchers receive higher amounts for serious defects.
It is noted that each report will be classified as “complete” or “incomplete” depending on the presence of fully functional exploits. Researchers will receive smaller rewards for theoretical attack scenarios.
Thus, for “incomplete” reports describing critical RCE, privilege escalation, and bypassing security mechanisms, one can earn a reward of up to $20,000. For “incomplete” reports on remote DoS attacks, the reward goes up to $15,000, while reports on spoofing, information disclosure, and incorrect documentation will earn specialists no more than $7,000.
“These updates are designed to enhance transparency and encourage the submission of detailed and actionable proposals that help improve the security of the entire .NET ecosystem,” Microsoft concluded.