Penetration Test Report (SecfaultSecurity): SecfaultSecurity Report B5x Security Assessment v1.1

SSeeccffaauulltt SSeeccuurriittyy
1Password in the Browser
Security Assessment
Report
FINAL
for
Agilebits Inc dba 1Password
4711 Yonge St., 10th Floor
Toronto,ON M2N 6K8 AgileBits
- hereafter called "Agilebits" -
This document contains proprietary and confidential information of Secfault Security and the recipient. Publication or distribution
without prior written permission is forbidden.
Secfault Security
Chapter
Document History
Version Author Date Comment
0.1 Leonard König 2022-06-24 First Draft
0.2 Gregor Kopf 2022-06-28 Internal Review
0.3 Leonard König 2022-07-27 Customer Comments
0.4 Dirk Breiden 2022-07-29 Last Customer Comment
1.0 Dirk Breiden 2022-07-29 Create Final Version
1.1 Gregor Kopf 2022-11-03 Included Additional Feedback
Secfault Security Confidential Page 2 of 17
Chapter
Table of Contents
1 Executive Summary..........................................................................................................................4
2 Overview..........................................................................................................................................5
2.1.1 Target Scope......................................................................................................................5
2.1.2 Test Procedures.................................................................................................................5
2.1.2.1 Native Messaging Host.............................................................................................6
2.1.2.2 1Password in the Browser.........................................................................................6
2.1.2.3 Save in 1Password API..............................................................................................6
2.2 Project Execution......................................................................................................................6
3 Result Overview...............................................................................................................................8
4 Results..............................................................................................................................................9
4.1 Browser Verification Bypass (Linux).......................................................................................9
4.2 Compromised Shared Lock State Leads to Full Data Access.................................................13
5 Additional Observations.................................................................................................................14
5.1 Unhandled Error Returns in Domain Punycode Conversion..................................................14
6 Customer Feedback........................................................................................................................15
6.1 Browser Verification Bypass (Linux) (Finding 4.1)...............................................................15
6.2 Compromised Shared Lock State Leads to Full Data Access (Finding 4.2)...........................15
6.3 Unhandled Error Returns in Domain Punycode Conversion (Finding 5.1)............................15
7 Vulnerability Rating.......................................................................................................................16
7.1 Vulnerability Types.................................................................................................................16
7.2 Severity...................................................................................................................................16
8 Glossary..........................................................................................................................................17
Secfault Security Confidential Page 3 of 17
Chapter 1
1 Executive Summary
Secfault Security was tasked by Agilebits with a security review of selected parts of the 1Password
ecosystem, namely "1Password in the browser" (b5x) along with its accompanying components.
The review has been performed in the time frame from 2022-06-07 to 2022-06-24. This document
describes the results of the project.
1Password in the browser aims to improve the integration between 1Password and web browsers, so
that for instance passwords and other sensitive information can be directly filled from within the
browser session. Furthermore, the "Save in 1Password" API enables selected web sites to allow
users to directly store confidential information into a 1Password vault.
During the review two issues, which are described in detail in section 4 of this document, have been
identified. Section 5 of this document provides additional observations and recommendations for
components that were not in scope of the review.
Overall, the reviewed codebase left a positive impression. The code is well-structured and readable
and a large number of common possible security issues have been avoided. This indicates that the
code has been implemented with security in mind.
After having received a draft version of this document, Agilebits provided feedback on the
identified issues, which can be found in section 6 of this document.
Secfault Security Confidential Page 4 of 17
Chapter 2
2 Overview
1Password is a password manager product developed and maintained by AgileBits Inc. The solution
provides a secure place for customers to store various passwords, software licenses, and other
sensitive information in virtual vaults.
Agilebits tasked Secfault Security with a review of the "1Password in the browser" feature as part
of their product suite, with its optional feature to share its lock state with the native app, removing
the need for duplicate password entry to unlock different components of 1Password.
Further, the "Save in 1Password" API to communicate with the aforementioned 1Password in the
browser extension, alongside with an NPM package helping to implement a button consuming this
API was part of the project.
In section 2.1.1 of this document, a description of the project's scope is provided. Section 2.1.2
provides details on the test procedures.
2.1.1 Target Scope
The following source code archives have been provided by Agilebits for review:
• core at revision release-stable-2.3.5
Furthermore, Agilebits provided the respective installation packages for 1Password in the browser
at the above mentioned revision, as well as links for downloads to the official 1Password desktop
client and the NPM package for the "Save in 1Password" API.
2.1.2 Test Procedures
The overall project followed a white-box approach, which means that Agilebits provided the source
code, the compiled binaries and technical documentation for the solution. Therefore, the solution
has been analyzed by performing a source code review, as well as targeted dynamic testing.
The source code review has been performed in a manual fashion, i.e., without relying on automated
vulnerability scanners or similar tools. Besides identifying possible classical implementation
weaknesses, one main focus of the review was the identification of potential logic problems. This
requires an in-depth understanding of the solution's inner workings, which is best achieved by a
manual process.
The dynamic tests have been performed in a targeted fashion. On the one hand, this served the
purpose of validating issues identified during the source code review. On the other hand, dynamic
tests were also performed to obtain a better understanding of the overall solution and the interplay
of its individual components.
Secfault Security Confidential Page 5 of 17
Chapter 2
2.1.2.1 Native Messaging Host
The NMH implementation has been reviewed, focusing on various types of implementation and/or
logical issues. On the one hand, the overall communication scheme between the NMH and the
1Password application has been subject to review. On the other hand, the communication between
the browser and the NMH has been analyzed.
This led to the identification of the issue described in section 4.1 of this docum