How to report a security vulnerability involving multiple unrelated companies?

Question

While participating in a bug bounty program, I stumbled upon an issue which led to a security vulnerability when exploited with other issues on unrelated products.

All those issues aren't security vulnerabilities per se, but they become one when combined. None of the issues is more critical than the others.

I would like that vulnerability to be fixed, so I plan to report it to vendors.

Following responsible disclosure guidelines, each report should not contain information about the other vendors' issues, but I'm afraid that all vendors will reject the report, explaining that their issue is the expected behavior.

Each vendor has a security program and a competent security team. The only problem is communicating the issues' impact to each of them.

What would be the best way to handle this problem?

Answer 1

Involve a trusted third n-th party.

While JonRB's approach can work, involving another trusted party, like a national or transnational CERT, can speed up the process and bring it to the desired outcome.

We have seen in the past, that big companies did not react properly to reports of major bugs/vulnerabilities in their products. The companies in question either did not react at all, did not try to develop a solution or sometimes the issue just got lost in a big corporate labyrinth. This ultimately led researchers to publishing vulnerabilities on their own to pressure vendors.

When you involve another trusted like a CERT, you can be ^relatively sure that the affected companies will realize the seriousness of the matter and handle the issue with a certain elevated attention.

Be sure though, that you trust the party that you plan to involve. If the companies that are involved are based in different countries there is probably no one single entity with authority over all of them. Luckily most of the world's bigger CERTs work together and are (somewhat) organized.

Answer 2

Intitial Communications

The first step here is to contact the security teams individually. Let them know that they are part of a bigger picture, but that you don't want to publicise the list of companies involved. It's important that you put in as much detail as you can without naming the companies, so that you aren't disregarded for being too vague.

It is also important to make it clear in your messaging that if each company does their part, this issue will be completely resolved. It may also be worth asking the company at this stage whether or not they are happy to be named in a more detailed report, so that they can work with each other more transparently.

Gather responses

You will now have to await the response of each team and assess how many "will not fix" responses you get. If companies are willing to be made aware of one another, you should be able to the security teams may be willing to reprioritised based on the new information. Otherwise you may have to produce some subset of the report for the companies that are happy to be named.

In any of your messaging, you can state that you have been able to obtain the information required for any missing steps using other companies that would rather not be named.

---

Aside

You may also want to look to the way the KRACK Attacks (for example) were handled with vendors to see how vendor-independent issues have been handled in the past.