Dealing with a vulnerability outside the scope of penetration test

Question

Hypothetical Situation: I am conducting a penetration test for a client. A scope of engagement has been defined of what I can and cannot do. While performing a vulnerability scan I come across a known vulnerability that is outside my scope. How do I go about professionally handling this?

Legally, I cannot perform any more assessments as I would be intentionally working outside of the scope. However, haven't I technically already stepped outside my scope? If I was to report on this, without performing any other penetration testing, could I run into any legal ramifications?

If I am in the clear legally, how would one properly deal with this? Is it better to report it to my client as a regular use who found a vulnerability would or would it be better to include this is a report?

If I am in the threat of legally being in trouble, what is the proper way of dealing with this to protect myself?

Answer 1

It is not possible to answer this completely without knowing a lot more detail.

However, in general, the first thing I'd want to know is how good a relationship you have with the client. By the sound of the restrictions placed on you, I'm guessing not so good which limits your options. The "best" thing would be to talk to the client as soon as you come across something. But as the likes of Snowden and others have discovered, this is not always a wise move.

Ultimately, this comes down to your contract. Any pen-test contract should have clauses that cover you for situations where vulnerabilities outside scope are discovered as a consequence of your in-scope work.

However, to deal with contract and legal complexities, you must consult a suitably knowledgeable legal expert. If you are a member of a trade group, they may also be able to assist. This forum obviously cannot give legal advice even if anyone here wanted to.

Answer 2

Ethically, you should always disclose your findings. Legally, you cannot go outside your scope. You may end up in a position where your report is not as thorough as you would like.

It is appropriate to advise the customer immediately that you found a vulnerability but could not investigate it fully without exceeding your scope. Maybe your scope can be adjusted, even if it's only a singular exception for this particular vulnerability. You should make it clear to your client that more information allows you to deliver a better assessment---but do so politely since they may be unwilling to consider taking any risks at all with a critical system. Some clients take time to decide on scope changes, so these issues should be communicated as soon as feasible.

If you have an employer, they may have a policy. This situation is not unheard of, and you probably have a ready-made answer if you work for an established company.

Whether your scope is expanded or not, you would normally address the vulnerability in your report to the extent that your data permits. If further investigation is not authorized, you should note that. If you can suggest any mitigations/fixes based on what you do know, you still do that. If not, you should explicitly state that no suggested mitigations or fixes are possible without further investigation.