Penetration Test Report (Cure53): Cure53 1PW17 report

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report 1Password B5 Web & API 10.-11.2021
Cure53, Dr.-Ing. M. Heiderich, MSc. S. Moritz, MSc. N. Krein
Index
Introduction
Scope
Identified Vulnerabilities
1PW-17-001 WP1: Reusable authorization token in localStorage (Medium)
1PW-17-003 WP2: Missing check allows spoofing of Activity Logs (Low)
1PW-17-004 WP2: DoS against other users via blocklist (Medium)
1PW-17-006 WP1: Client-side DoS via invalid encrypted data in vaults (High)
Miscellaneous Issues
1PW-17-002 WP2: Inconsistent check leads to faulty Activity Logs (Low)
1PW-17-005 WP2: Information disclosure via WebSocket channel (Low)
Conclusions
Introduction
“1Password is the easiest way to store and use strong passwords. Log in to sites and fill
forms securely with a single click.”
From https://1password.com/
This report describes the results of a security assessment of the 1Password B5 web
application complex. Carried out by Cure53 in October 2021, the project included a
penetration test and a dedicated audit of the source code.
Registered as 1PW-17, the project was requested by 1Password in April 2021 and then
scheduled as part of the more structured series of security-centered assessments
conducted by Cure53 for the 1Password team. Examinations of the 1Password B5
application have taken place with certain regularity in 2020 and 2021.
As for the precise timeline and specific resources allocated to 1PW-17, Cure53
completed the examination in mid-to-late October 2021, namely in CW40 and CW41. A
total of fourteen days were invested to reach the coverage expected for this assignment,
whereas a team of three senior testers has been composed and tasked with this
Cure53, Berlin · 11/23/21 1/16
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
project’s preparation, execution and finalization. All testers in this group were already
familiar with the 1Password B5 web app compound via previous project work.
For optimal structuring and tracking of tasks, the work was split into two separate work
packages (WPs):
• WP1: 1Password B5 web application frontend, written predominantly in TS
• WP2: 1Password B5 web application backend, written predominantly in GoLang
Cure53 was given access to a dedicated 1Password B5 test environment as well as
furnished with all relevant sources. Additionally, test-supporting documentation, lots of
details pertinent to focus areas and related documentation were provided to make sure
the project can be executed in line with the agreed-upon framework. Following best
practices established during past cooperation, the methodology utilized in 1PW-17 was
accordingly white-box.
The project progressed effectively on the whole. All preparations were done in CW39 to
foster a smooth transition into the testing phase. Over the course of the engagement, the
communications were done using a private, dedicated and shared Slack channel which
was spun up by 1Password. All partaking team members could join test communications
there. The discussions throughout the test were very good and productive and not many
questions had to be asked. The scope was well-prepared and clear, with no noteworthy
roadblocks encountered during the test.
Cure53 offered frequent status updates about the test and the emerging findings. Live-
reporting was performed as usual and the Cure53 team managed to acquire good
coverage over the test targets delineated for WP1 and WP2 of this 1PW-17 project.
Among six security-relevant discoveries, four were classified to be security vulnerabilities
and two to be general weaknesses with lower exploitation potential. It needs to be noted
that this is a good result for 1Password, largely asserting that frequent engagement with
external tests and audits positively contributes to the security posture of the complex.
None of the findings were marked as Critical and only one discovery represented a
borderline High risk. This problem would let an attacker cause a DoS of the 1Password
account under certain circumstances related to invalid vault data submission. Other
flaws related to DoS and possible reuse of leaked information in browser storage
containers. Both the severities and the total number of issues can be seen as
manageable.
Cure53, Berlin · 11/23/21 2/16
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
In the following sections, the report will first shed light on the scope and key test
parameters, as well as the structure and content of the WPs. Next, all findings will be
discussed in grouped vulnerability and miscellaneous categories, then following a
chronological order in each group. Alongside technical descriptions, PoC and mitigation
advice are supplied when applicable. Finally, the report will close with broader
conclusions about this autumn 2021 project. Cure53 elaborates on the general
impressions and reiterates the verdict based on the testing team’s observations and
collected evidence. Tailored hardening recommendations for the 1Password B5 web
application complex are also incorporated into the final section.
Cure53, Berlin · 11/23/21 3/16
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Penetration-Tests & Code Audits against 1Password B5 Web Application
◦ WP1: 1Password B5 Web Application Frontend, written predominantly in TS
▪ Test environment:
• https://1pw17testcompany.b5test.com /
▪ All relevant sources were shared with Cure53
◦ WP2: 1Password B5 Web Application Backend, written predominantly in GoLang
▪ Key focus areas:
• New 1Password vault invite flow
• Service account authorization feature
• Item sharing feature
• Duo v4 MFA integration
▪ All relevant sources were shared with Cure53
• Test user-accounts:
◦ https://1pw17testcompany.b5test.com /
▪ U: seba@cure53.de
▪ U: niko@cure53.de
◦ https://1pw17second.b5test.com /
▪ U: seba@cure53.de
◦ https://1pw17third.b5test.com
▪ U: seba@cure53.de
◦ https://1pw17fourth.b5test.com
▪ U: seba@cure53.de
◦ Duo MFA:
▪ https://admin-da89dc78.duosecurity.com/login
▪ U: seba@cure53.de
◦ Test-supporting material was shared with Cure53
◦ All relevant sources were shared with Cure53
Cure53, Berlin · 11/23/21 4/16
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in chronological order rather than by their
degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. 1PW-17-001) for the purpose of facilitating any
future follow-up correspondence.
1PW-17-001 WP1: Reusable authorization token in localStorage (Medium)
Note: The 1Password team has accepted this finding as a low severity issue. They
cannot follow the provided recommendation for usability reasons, but are looking to
mitigate the risk of accidentally long-lived authentication tokens by introducing an opt-
out for storing this in a future version of item sharing.
During the assessment of the newly introduced item sharing feature, the discovery was
made that the currently implemented authentication mechanism is prone to several local
attack scenarios. The feature furnishes the option to define a set of accessors via email
addresses. These determine where the item can be shared.
After the email gets confirmed via an OTP token, an additional authorization token is
returned and is stored in the localStorage. Due to the fact that items in the localStorage
remain after the browser is closed and the token is reusable, a local acting adversary is
able to use this token to access all valid items shared with the email address.
Moreover, the expiration date of the authorization