Penetration Test Report (RecurityLabs): 378.2101 Recurity Labs Report B5 v1.0

Recurity Labs GmbH
https://www.recurity-labs.com
B5
Security Assessment
Project No. 378.2101
Report
FINAL
for
Agilebits Inc dba 1Password
4711 Yonge St., 10th Floor
Toronto, ON M2N 6K8
Canada
Report Recurity Labs
378.2101 Page 1 of 25
Recurity Labs GmbH
https://www.recurity-labs.com
Document Versions and Changes
Version Author Date Comment
0.1 Bruno Kirschner 2022-03-18 Initial draft
0.2 Bruno Kirschner 2022-03-24 Additions
0.3 Micaela Ranea-Sánchez 2022-03-25 Additions
0.4 Micaela Ranea-Sánchez 2022-03-29 Additions
0.5 Andreas Lindh 2022-03-30 Technical review
0.6 Micaela Ranea-Sánchez 2022-03-30 Clarifications
0.7 Nico Lindner 2022-03-31 Editorial review
0.8 Nico Lindner 2022-04-27 Incorporating feedback
0.9 Bruno Kirschner 2022-05-03 Retest of finding 378.2101.002
0.10 Micaela Ranea-Sánchez 2022-05-09 Retest of finding 378.2101.003
0.11 Nico Lindner 2022-05-10 Review
0.12 Micaela Ranea-Sánchez 2022-05-16 Fix typos
1.0 Nico Lindner 2022-05-17 Final version based on v0.12
Report Recurity Labs
378.2101 Page 2 of 25
Recurity Labs GmbH
https://www.recurity-labs.com
Table of Contents
1 Executive Summary............................................................................................................5
1.1 Table of Findings..............................................................................................................6
2 Project Background.............................................................................................................7
2.1 Team................................................................................................................................7
2.2 Analyzed System..............................................................................................................7
2.3 Procedures.......................................................................................................................9
2.3.1 Guest and Unconfirmed Users....................................................................................10
2.3.2 Personal and Family Accounts....................................................................................10
2.3.3 Session Persistance....................................................................................................11
2.3.4 Billing...........................................................................................................................11
2.3.5 Item Sharing................................................................................................................12
2.3.6 Vault Invites.................................................................................................................12
3 Findings in Detail...............................................................................................................13
3.1 Weak TLS Configuration................................................................................................13
3.2 Unconfirmed Family Member Access Other Members Metadata....................................16
3.3 Potential CSV Injection...................................................................................................18
3.4 Secrets in SessionStorage Stay Accessible After Login Abortion...................................21
4 General Recommendations...............................................................................................24
4.1 Centralized (Documentation of) Access Control.............................................................24
4.2 Deny-list for Email Provider Domains.............................................................................24
5 Explanation of Classification..............................................................................................25
5.1 Type...............................................................................................................................25
5.2 Effort...............................................................................................................................25
5.3 Impact............................................................................................................................25
Report Recurity Labs
378.2101 Page 3 of 25
Recurity Labs GmbH
https://www.recurity-labs.com
Terms and Definitions
Term Definition
2FA Two-Factor Authentication
API Application Programming Interface
AWS Amazon Web Services
BSI Bundesamt für Sicherheit in der
Informationstechnik
CSV Comma Separated Value
DoS Denial-of-Service
EC2 Amazon Elastic Compute Cloud
GUI Graphical User Interface
ID Identification
IETF Internet Engineering Task Force
JSON JavaScript Object Notation
MFA Multi-Factor Authentication
n/a not applicable / not available
PFS Perfect-Forward Secrecy
TLS Transport Layer Security
URL Uniform Resource Locator
UUID Universally Unique Identifier
Report Recurity Labs
378.2101 Page 4 of 25
Recurity Labs GmbH
https://www.recurity-labs.com
1 Executive Summary
AgileBits requested consultation by Recurity Labs to perform a time-boxed security
assessment of the Web application version of their password manager, also referred to as
"B5". The background of this assessment is provided by the regular review policy followed by
AgileBits. In conformance with this policy, the application has been reviewed by multiple
other security consultancy companies in the course of the last years.
Specifically, Recurity Labs was tasked to perform an application-level security audit of the B5
application with a general focus on the user-role model of family and business accounts,
paying special attention to unconfirmed and guest accounts. Due to the size and complexity
of the application and the time-boxed nature of this assessment, it must be noted that
Recurity Labs was not able to perform an exhaustive review of the application in its entirety.
More details on the features reviewed can be obtained from section 2.3.
Summarizing the present assessment, the analysis revealed that the application can be
considered to be in a good condition from an IT security perspective. No critical impact
findings have been discovered, and the security posture of the code base seems to be
strong. Nevertheless, four issues have been identified in the solution. Most noteworthy are
the possibility for unconfirmed members of a family to fetch metadata from business-internal
vaults, as described in detail in section 3.2, and secrets which remain in the sessionStorage
after an aborted log-in attempt, as described in section 3.4. The TLS configuration of the
AWS servers in place for the testing environment were found to support cipher suites not
providing Perfect Forward Secrecy (PFS), and use the SHA1 hashing algorithm, as described
in section 3.1. In addition, the Group API was found to allow users to fetch CSV files from the
server, containing potentially dangerous values, which are neither sanitized nor encoded, as
described in section 3.3.
All findings, including detailed reproduction steps and recommendations, can be found in
section 3.
Apart from the findings described above, analyzing the provided documentation and source
code, it is clear to Recurity Labs that AgileBits could benefit from improving the Access
Control implementation of B5, as described in section 4.1. This and other recommendations
are listed in section 4.
Feedback provided by AgileBits
AgileBits provided feedback on the findings via Email on 2022-04-14 and requested the
incorporation into this report. The feedback has been appended to the respective findings'
sections in chapter 3 and commented upon by Recurity Labs, where applicable.
Retest Status (May 2022)
After the initial assessment, AgileBits provided fixes for two (378.2101.002 & 378.2102.003)
of the four identified issues. Recurity Labs confirmed their mitigation as part of an
intermediate retest cycle, denoted in this document as Retest Status (May 2022). Further
details are provided as additions to the relevant subsections. Findings not in-scope of the
retest activities (378