Issue Reporting Vulnerabilities should be a lot easier!!!

[JamesWhitaker]

Recently I found what I believed to be a security vulnerability in Plesk.
After several hours of investigation, I wrote a detailed report setting out my findings and explaining how the bug could be reproduced.
I wanted to share that report with the Plesk team so that the security vulnerability could be fixed (responsible disclosure).
However, contacting Plesk turned out to be a huge problem.

I first wrote to the email-address listed on the Plesk Github page ([email protected]), but recieved a reply from Microsoft stating that this address did not exist or did not accept emails.
I then tried to create an account on this forum, but due to technical difficulties it was not possible to activate my account at that time.
I tried to submit a request to the support team, but was blocked by the system because my license is provided by my hosting provider, and I'm therefore not eligible for direct support.
I searched the entire Plesk website for contact information, but only found this (Contact Us - Plesk Support Will Help).

I submitted a message detailing my problem and asking for a way to report the security vulnerability.
The (sales) staff were unwilling to address this and said I needed to purchase a support licence.

Over the next couple of weeks I tried to tell them I was not looking for support and wanted to REPORT a vulnerability.
The answer remained the same.

At some point someone even said to contact my hosting provider and that it was their problem. (I tried that and they referred me back to Plesk straight away (obviously).)

After about three weeks, I gave up and wrote one final message in which I expressed my dissatisfaction in no uncertain terms about the way the situation had been handled.
Eventually, a supervisor stepped in and gave me permission to submit my report, which she would then forward to the developers.
They have since investigated and fixed the bug.


Dear Plesk, reporting vulnerabilities should be A LOT easier!


PS; Even if I would have been able to open an account on this forum at the time, I still would have had a problem.
I can hardly publish an active exploit on a public forum.
There really should be a contact form for the dev/security-team for this purpose.

 

[Sebahat.hadzhi]

Hi, @JamesWhitaker . Thank you for sharing your experience. I am sorry to hear it took so much effort on your part to get the vulnerability report to our team. We appreciate the time and effort you invested in helping us improve the security of Plesk. Your feedback about the lack of reporting procedure clarity is valid. I will bring this case to the attention of our team for further consideration of improving the vulnerability reporting process.

To clarify the current process, customers using Plesk through a partner can generally raise product-related issues with their provider, who can escalate the case to Plesk when further investigation is needed. Nevertheless, we recognize that these support arrangements should not make it difficult to identify the appropriate route for reporting a potential security vulnerability.

Regarding the forum registration issue, our Customer Support team got in touch with our IT team and they investigated the email delivery problem. The forum's outgoing mail service was operating normally, but the confirmation messages were rejected by external mail service provider. We understand that this created an additional obstacle when you were already trying to find a way to contact us.

Again, we apologize for the frustration and inconvenience this caused, and we appreciate your contribution to Plesk.