Penetration Test Report (RecurityLabs): 378.2202.Recurity Labs Report Service Accounts v1.2

Recurity Labs GmbH
https://www.recurity-labs.com
1Password CLI Service Accounts
Security Assessment
Project No. 378.2202
Report
FINAL
for
Agilebits Inc dba 1Password
4711 Yonge St., 10th Floor
Toronto, ON M2N 6K8
Canada
Report Highly Confidential Recurity Labs
378.2202 Page 1 of 11
Recurity Labs GmbH
https://www.recurity-labs.com
Document Versions and Changes
Version Author Date Comment
0.1 Micaela Ranea-Sánchez 2022-07-14 Initial draft
0.2 Carsten Wentzlow 2022-07-20 Additions
0.3 John Lißke 2022-07-20 Technical review
0.4 Micaela Ranea-Sánchez 2022-07-20 Clarifications
0.5 Nico Lindner 2022-07-21 Editorial review
0.6 Micaela Ranea-Sánchez 2022-07-21 Clarifications
0.7 Nico Lindner 2022-07-21 Review
0.8 Micaela Ranea-Sánchez 2022-07-27 Incorporating feedback1
0.9 Nico Lindner 2022-07-27 Review
0.10 Micaela Ranea-Sánchez 2022-07-27 Incorporating feedback2
1.0 Nico Lindner 2022-07-29 Final version based on v0.103
1.1 Nico Lindner 2022-10-14 Incorporating feedback4
1.2 Nico Lindner 2022-10-14 Final version based on v1.1
1 solely wording-related changes
2 solely wording-related changes
3 solely finalizing- and format-related changes, no changes in technical content
4 Minor changes to wording in non-technical chapters. Removal of the Appendix section (example of JSON payload) and
references to it, for non-disclosure of sensitive data.
Report Highly Confidential Recurity Labs
378.2202 Page 2 of 11
Recurity Labs GmbH
https://www.recurity-labs.com
Table of Contents
1 Executive Summary............................................................................................................5
1.1 Table of Findings..............................................................................................................5
2 Project Background.............................................................................................................6
2.1 Project History..................................................................................................................6
2.2 Team................................................................................................................................6
2.3 Analyzed System..............................................................................................................6
2.4 Procedures.......................................................................................................................8
3 Findings in Detail.................................................................................................................9
3.1 Improper Error Handling...................................................................................................9
4 Explanation of Classification..............................................................................................11
4.1 Type................................................................................................................................11
4.2 Effort...............................................................................................................................11
4.3 Impact.............................................................................................................................11
Report Highly Confidential Recurity Labs
378.2202 Page 3 of 11
Recurity Labs GmbH
https://www.recurity-labs.com
Terms and Definitions
Term Definition
API Application Programming Interface
CLI Command-line Interface
DoS Denial-of-Service
HTTP Hyper Text Transfer Protocol
ID Identification
Report Highly Confidential Recurity Labs
378.2202 Page 4 of 11
Recurity Labs GmbH
https://www.recurity-labs.com
1 Executive Summary
Recurity Labs was tasked by AgileBits to perform a time-boxed security assessment of the
newly implemented Service Accounts feature, added to the 1Password password manager.
This assessment was performed in the context of the regular review policy followed by
AgileBits. In conformance with this policy, the application has been audited by multiple other
security consultancy teams in the course of the last years, something clearly noticeable when
assessing the components of the solution. In a previous testing cycle, Recurity Labs was
tasked with assessing the 1Password Server API in itself5. Please also refer to chapter 2.1.
In the present assessment, the scope was placed on the Service Accounts and their
integration both in the 1Password Server API, 1Password Web application (publicly available
at the domain 1password.com) and 1Password CLI, the Go -based command-line client of the
password manager6.
Summarizing the assessment, the Service Accounts feature was found to be in good
condition, from a security standpoint. No critical issues could be identified, and only one
issue with unknown security impact (rated Informational) has been identified. Specifically,
during the assessment, the observation was made that the server issues HTTP Error 500
responses for some invalid API calls. The root cause of these errors is unknown, also, since
the conducted source code analysis did not reveal any missing error handling. Further
technical information can be found in section 3.1, including reproduction steps and a
recommendation for further analysis.
Additional notes on the areas covered and their high-level results can be obtained from
section 2.4.
In conclusion, Recurity Labs wants to mention that the overall code quality was found to be
remarkably good, and structurally sound.
Remark
In this document, "Service Accounts" is used when referring to the feature, and "service
accounts" as the actual account(s) of type service.
1.1 Table of Findings
The following table summarizes the findings Recurity Labs made during the assessment.
Each finding is briefly described by its title, its type as well as the effort and impact of a
successful exploitation. Technical details for the individual findings are provided in the
respective sections of chapter 3 of this document. Details regarding Recurity Labs' rating
scheme are provided in section 4.
ID Description Chapter Effort Impact
378.2202.1 Improper Error Handling 3.1 N/A Informational
5 https://bucket.agilebits.com/security/378.2101-Recurity_Labs-Report-B5-v1.0.pdf
6 https://1password.com/downloads/command-line/
Report Highly Confidential Recurity Labs
378.2202 Page 5 of 11
Recurity Labs GmbH
https://www.recurity-labs.com
2 Project Background
Recurity Labs was tasked by AgileBits to perform a time-boxed security assessment of the
newly implemented Service Accounts feature, added to the 1Password password manager.
Service accounts are intended to help developers build tools to automate secrets
management within applications and infrastructure.
2.1 Project History
The current iteration is based on the following previously executed assessments:
Project ID Title Date Report
378.2101 B5 Security Assessment March 2[PII_REDACTED]-Recurity_Labs-Report-B5-
v1.0.pdf
2.2 Team
The assessment was conducted between July 04th and 15th in 2022 by Carsten Wentzlow
and Micaela Ranea-Sánchez of Recurity Labs. Support was provided by the responsible
personnel at AgileBits throughout the project, and Florian Grunert of Recurity Labs as the
responsible project manager.
2.3 Analyzed System
The assessment was performed against a test environment available at the domain
b5test.com.
Multiple user accounts were created by the team, using the following email addresses
(provided here to ease the clean-up process at AgileBits):
• carsten1@recurity-labs.com
• mica1@recurity-labs.com to mica4@recurity-labs.com
A shared vault was created by AgileBits, available at 1passwordrecuritylabs.1password.com.
The following documents were provided:
Name Content SHA256
b5-main.tar.gz 1Password Server API and f6ef03723c53c0c29d6ecdb8e5
Web application source code 2669cf83ad8a666db5557ff078
165c7a4bef25
op-binaries.zip 1Password CLI binaries for 19420e60f58eaa61d31e3e93e1
different architectures a05b2b4c7b3b19e0a00ed82d5a
82ec1693ea37
op.zip 1Password CLI source code 26dbb8f2edebf979a9b9338