Penetration Test Report (SecfaultSecurity): SecfaultSecurity Report OP Security Assessment v1.0

SSeeccffaauulltt SSeeccuurriittyy
OP Security Assessment
Security Assessment
Report
for
Agilebits Inc dba 1Password
4711 Yonge St., 10th Floor
Toronto,ON M2N 6K8 AgileBits
- hereafter called "Agilebits" -
This document contains proprietary and confidential information of Secfault Security and the recipient. Publication or distribution
without prior written permission is forbidden.
Secfault Security
Chapter
Document History
Version Author Date Comment
0.1 Jennifer Gehrke 2022-02-23 First Draft
0.2 Gregor Kopf 2022-03-01 Additions and Corrections
0.3 Maik Münch 2022-03-03 Internal Review
0.4 Dirk Breiden 2022-03-03 Customer Version
0.5 Gregor Kopf 2022-03-16 Included Customer Feedback
0.6 Gregor Kopf 2022-04-04 Included Additional Customer Feedback
0.7 Gregor Kopf 2022-04-08 Minor Changes in Customer Feedback
1.0 Gregor Kopf 2022-04-27 Final Version
Secfault Security Confidential Page 2 of 34
Chapter
Table of Contents
1 Executive Summary..........................................................................................................................4
2 Overview..........................................................................................................................................5
2.1 Target Scope..............................................................................................................................5
2.2 Test Procedures.........................................................................................................................5
2.3 Project Execution......................................................................................................................5
3 Result Overview...............................................................................................................................7
4 Results..............................................................................................................................................8
4.1 CLI Tools..................................................................................................................................8
4.1.1 Lax Parsing for Dotenv Files............................................................................................8
4.1.2 Output of Escape Sequences...........................................................................................10
4.1.3 Race Condition in File Creation......................................................................................12
4.1.4 Access to Parent Environment in op run.........................................................................15
4.1.5 Missing Privilege Dropping in op run.............................................................................17
4.1.6 Secret Data in Command Arguments..............................................................................18
4.1.7 ToCToU Weakness in Windows Peer Verification..........................................................19
4.2 SSH Agent...............................................................................................................................20
4.2.1 Insufficient Peer Verification on Unix Sockets...............................................................20
4.2.2 Unauthenticated Meta Information in Database.............................................................23
5 Additional Observations.................................................................................................................26
5.1 SSH Key Title Uniqueness.....................................................................................................26
5.2 SSH Key Title Manipulations.................................................................................................26
5.3 SSH Private Key Export.........................................................................................................27
5.4 Prompt for Unknown SSH Key..............................................................................................28
6 Customer Feedback........................................................................................................................30
6.1 Lax Parsing for Dotenv Files (Finding 4.1.1).........................................................................30
6.2 Output of Escape Sequences (Finding 4.1.2)..........................................................................30
6.3 Race Condition in File Creation (Finding 4.1.3)....................................................................30
6.4 Access to Parent Environment in op run (Finding 4.1.4)........................................................30
6.5 Missing Privilege Dropping in op run (Finding 4.1.5)...........................................................30
6.6 Secret Data in Command Arguments (Finding 4.1.6).............................................................30
6.7 ToCToU Weakness in Windows Peer Verification (Finding 4.1.7).........................................31
6.8 Insufficient Peer Verification on Unix Sockets (Finding 4.2.1)..............................................31
6.9 Unauthenticated Meta Information in Database (Finding 4.2.2)............................................31
7 Vulnerability Rating.......................................................................................................................32
7.1 Vulnerability Types.................................................................................................................32
7.2 Exploitability and Impact........................................................................................................32
8 Glossary..........................................................................................................................................34
Secfault Security Confidential Page 3 of 34
Chapter 1
1 Executive Summary
Secfault Security was tasked by Agilebits with a security review of selected components of the
1Password ecosystem, namely the CLI integration and the SSH agent functionality. The review has
been performed in the time frame from 2022-02-14 to 2022-03-01. This document describes the
results of the project.
During the review a number of issues, which are described in detail in section 4 of this document,
have been identified. One of the more severe issues might allow sufficiently-privileged local
attackers to trick the user into granting SSH agent authorization for malicious processes. Other
issues include problems with the way the CLI handles the execution of external commands, which
could result in malicious processes started by the CLI being able to obtain access to the user's
1Password session. Additionally, a number of minor problems have been identified, including for
instance the insecure handling of terminal escape sequences or the use of lax parsers.
Section 5 of this document provides a number of additional observations and recommendations.
This includes an approach for addressing the known security issue concerning the manipulation of
SSH key titles as shown in the approval prompt.
Overall, the reviewed codebase left a positive impression. The code is well-structured and readable
and has been implemented with security in mind.
After having received a draft version of this document, Agilebits provided feedback on the
identified issues, which can be found in section 6 of this document.
Secfault Security Confidential Page 4 of 34
Chapter 2
2 Overview
1Password is a password manager product developed and maintained by AgileBits Inc. The solution
provides a secure place for customers to store various passwords, software licenses, and other
sensitive information in virtual vaults.
Agilebits tasked Secfault Security with a review of selected parts of the CLI implementation and the
SSH integration of the solution.
In section 2.1 of this document, a description of the project's scope is provided. Section 2.2 provides
details on the test procedures.
2.1 Target Scope
The following source code repositories have been provided by Agilebits f