Penetration Test Report (Cure53): Cure53 B5 1PW 06 report.v2

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report 1Password B5 & Permissions 10.2020
Cure53, Dr.-Ing. M. Heiderich, MSc. S. Moritz, MSc. R. Peraglie, Dr. N. Kobeissi
Index
Introduction
Scope
Identified Vulnerabilities
1PW-06-003 API: Blocking users from registration through rate-limiting ( Low )
1PW-06-004 API: Lack of ACL on endpoints returning user-data (Low)
1PW-06-007 API: Joining members can add arbitrary vaults to account ( High )
1PW-06-008 Crypto: Insufficient public key validation criteria ( Low )
1PW-06-009 Crypto: UKS attack potential on public key operations ( Info )
Miscellaneous Issues
1PW-06-001 Web: Blocklist bypassable via X-Forwarded-For header (Low)
1PW-06-002 Web: Faulty CORS configuration (Info)
1PW-06-005 Crypto: Private key remains static after vault password reset ( Medium )
1PW-06-006 Crypto: 1Password vaults vulnerable to server compromise ( Medium )
1PW-06-010 Crypto: Malfunctioning and unused cryptography components (Info)
Conclusions
Cure53, Berlin · 12/10/20 1/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Introduction
“The easiest and safest way to share logins, passwords, credit cards and more, with the
people that matter most. Go ahead, forget your passwords – 1Password remembers
them all for you.”
From https://1password.com/
This report presents the results of a security assessment targeting the 1Password B5
feature compound, which essentially describes the 1Password web application. Carried
out by Cure53 in October 2020, the project encompassed a penetration test and a
source code audit. Ten discoveries, including one marked as High severity, have been
made on the 1Password’s scope during this assignment.
To give some context, the project was requested by 1Password and executed by four
members of the Cure53 team in Calendar Weeks 43 and 44 of 2020. The 1Password B5
web application was tested by Cure53 before, indicating that the project has been
completed in the frames of broader cooperation centered on security aspects. Since
1PW-01, which took place in early 2019, most of subsequent tests focused on the client
software or specifically chosen features. In this test, the focus was solidly placed on the
B5 web application itself and, most importantly, on the 1Password permission
enforcement utilized by the B5 web application in both frontend and backend.
Making sure that the work can be properly structured and cover all relevant aspects of
the scope, Cure53 worked with two work packages (WPs) with the following contents:
• WP1: Penetration-Tests & Audits against 1Password B5 Web Application UI;
• WP2: Penetration-Tests & Audits against 1Password B5 Web Backend & API.
The scope was well-prepared by 1Password and the Cure53 team can make good
progress during fourteen person-days dedicated to this project. Good coverage levels
and proper research depth were achieved. As usual for engagements carried out by
Cure53 for 1Password, a dedicated, private Slack channel was used to connect all
involved staff in real-time exchanges. Communications were productive and helpful with
all Cure53’s questions answered in a prompt and comprehensive manner. Status details
and information about the spotted findings, as well as the resulting possible attack
scenarios, were shared once confirmed.
Moving on to results, the Cure53 team managed to spot a total of ten findings, as
mentioned above. More specifically, five problems were classified to be security
vulnerabilities of varying severity levels. The remaining five items can be seen as
general weaknesses, typically - but not entirely in this case- characterized by lower
Cure53, Berlin · 12/10/20 2/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
exploitation potential. Of note is the fact that one item overall received marks linked to
elevated seriousness. The presence of severe problems among Miscellaneous issues
can be explained by them being reported before in PW-01. Since they have not been
fully addressed, Crue53 lists them for completeness’ sake. Despite the number and
scope of findings, the results are leaning to a positive verdict. This is driven by the fact
that especially the focal areas, meaning the enforcement of the 1Password permissions.
stood strong against the approach attempted by Cure53.
In the following sections, the report will first shed light on the scope and key test
parameters. Next, all findings will be discussed in grouped vulnerability and
miscellaneous categories, then following a chronological order. Alongside technical
descriptions, PoC and mitigation advice are supplied when applicable. Finally, the report
will close with broader conclusions about this autumn 2020 project. Cure53 elaborates
on the general impressions and reiterates the verdict based on the testing team’s
observations and collected evidence. Tailored hardening recommendations for
1Password B5 web application and 1Password permission enforcement are also
incorporated into the final section.
Note: This report was updated in early December and notes were added to several
tickets to reflect the state of updated severities after the tickets have been reported to
and discussed with the 1Password team.
Cure53, Berlin · 12/10/20 3/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Penetration-Tests & Source Code Audits against 1Password B5 Web Application
◦ WP1: Penetration-Tests & Audits against 1Password B5 Web Application UI
▪ Tests performed locally on https://my.b5local.com:3000
▪ The application must, therefore, be built on the test-machine from the supplied
sources to be able to run it locally.
▪ More information can be found in the provided instructions.md from the B5
sources
◦ WP2: Penetration-Tests & Audits against 1Password B5 Web Backend & API
▪ Tests performed locally on https://my.b5local.com:3000
▪ Note that this engagement aimed at a holistic and thorough review of the
1Password permission enforcement, covering the review of cryptography-,
server-, and client-enforced policies
◦ Sources were shared with Cure53
◦ Test-supporting material was shared with Cure53
Cure53, Berlin · 12/10/20 4/19
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in chronological order rather than by their
degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. 1PW-06-001) for the purpose of facilitating any
future follow-up correspondence.
1PW-06-003 API: Blocking users from registration through rate-limiting (Low)
Note: Upon review 1Password disagreed with Cure53's description of the working of the
rate limiting. As a result, 1Password believes the presented risk for brute force attacks is
significantly lower than originally presented and requested the severity to be set to low.
1Password will take Cure53's assessment into account to further improve its rate limiting
and blocking infrastructure in the future.
During the assessment of the B5 web application, it was found that the implemented
protection against brute-force attacks on the sign-up verification endpoint could be used
to prevent users from registering with the application. If more than 25 requests are sent
to the endpoint within a short amount of time, the server responds with the status 429
Too many Requests (see below).
At first glance, it appears to be a normal rate-limiting but, in fact, the limit is not bound to
the IP of the client but rather to the email address sent in the request. This makes it
possible for an attacker to prevent other users from finishing th