Penetration Test Report (Cure53): Cure53 B5 automations 1PW 14 report

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Pentest-Report 1Password B5 Web & API 05.2021
Cure53, Dr.-Ing. M. Heiderich, MSc. S. Moritz, Dipl.-Ing. A. Inführ, BSc. B. Walny
Index
Introduction
Scope
Identified Vulnerabilities
1PW-14-002 WP2: DoS on SCIM bridge via Groups route (Low)
1PW-14-003 WP2: ACL bypass of Events via JWT token manipulation (Medium)
1PW-14-006 WP1: Client-side DoS via missing sign-in URL validation (Low)
Miscellaneous Issues
1PW-14-001 WP1: General HTTP security headers missing (Medium)
1PW-14-004 WP2: Security of events endpoint weakened by gob parsing (Info)
1PW-14-005 WP2: HTTP path traversal in CLI login implementation (Info)
1PW-14-007 WP1: Cross-Origin-related HTTP security headers missing (Info)
Conclusions
Introduction
“The information you store in 1Password is encrypted, and only you hold the keys to
decrypt it. 1Password is designed to protect you from breaches and other threats, and
we work with other security experts to make sure our code is rock solid. We can’t see
your 1Password data, so we can’t use it, share it, or sell it.”
From https://1password.com/security/
This report describes the results of a security assessment that Cure53 carried out
against the 1Password scope in late May and early June of 2021. It is important to note
that the project fits into the broader security-centered collaboration between the
1Password and Cure53 teams. For this particular assignment, headlined 1PW-14,
Cure53 conducted a penetration test and a dedicated source code audit, focusing on the
1Password B5 Web Application. Therefore, an emphasis during this examination was
placed on several selected, updated or newly implemented features.
To give some context, the work was requested by 1Password in March 2021 and then
scheduled for later months. The Cure53 testing team punctually completed the
Cure53, Berlin · 07/29/21 1/20
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
assessment in CW22 and CW23, meaning May and June 2021. A total of twenty days
were invested to reach the coverage expected for this project and a team of four senior
testers had been assigned to this project’s preparation, execution and finalization.
The work was structured and split into two work packages (WPs). In WP1, Cure53
examined the 1Password B5 web application frontend, written predominantly in
TypeScript, whereas WP2 was said to center on the 1Password B5 web application
backend, written predominantly in GoLang. Note that the actual scope was actually less
driven by the pre-defined and rather generic work packages but rather informed by the
features that were deemed as warranting more attention. The key focus areas defined
by 1Password for Cure53 to look for during their investigations are listed next.
• Focus Area 1: Pentest & Audit against the 1Password CLI for B5 (“op”)
• Focus Area 2: Pentest & Audit against the Secrets Automation
• Focus Area 3: Pentest & Audit against the SCIM bridge
• Focus Area 4: Pentest & Audit against Events streaming
The methodology chosen here was white-box, mostly driven by the aim of acquiring
optimal coverage and depth. Cure53 was given access to the application in scope rolled
out on a dedicated test instance, very detailed documentation about scope and
expectations as well as all relevant credentials and sources, as usual for 1Password
engagements. It has been paramount that all four test-team members were already well-
versed with the 1Password software complex and have participated in similarly scoped
audits in the past.
All preparations were done in late May, namely in CW21. This meant Cure53 could have
a smooth start and full access to all scope-relevant data before the actual start of the
project. Communications during the test were done in a dedicated and shared Slack
channel, as is usual for projects between Cure53 and 1Password. All involved personnel
could join the channel relevant for this work.
It must be underlined that 1Password’s preparatory work was excellent as usual and so
were the communications. Not many questions had to be asked, no noteworthy
roadblocks were encountered during the test. Therefore, the project could be completed
at a good pace and with great efficiency. Cure53 furnished frequent status updates
about the test and the related findings. Live-reporting was executed for several of the
issues listed in this report.
Moving on to the findings, the Cure53 team managed to get very good coverage over
the WP1-2 scope items and spotted seven findings. Three were classified to be security
vulnerabilities and four should be seen as be general weaknesses with lower exploitation
Cure53, Berlin · 07/29/21 2/20
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
potential. This is a really good result, especially given the fact that former pentests
revealed greater weakness, both in terms of number and severity of the issues spotted.
Subsequently, in the current 1PW-14 assignment, none of the spotted findings managed
to get past Medium impact. To summarize, the impressions gained from this assessment
regarding security and privacy of the 1Password B5 complex are pretty good.
In the following sections, the report will first shed light on the scope and key test
parameters, as well as the structure and content of the WPs/focus areas. Next, all
findings will be discussed in grouped vulnerability and miscellaneous categories, then
following a chronological order in the second group Alongside technical descriptions,
PoC and mitigation advice are supplied when applicable. Finally, the report will close
with broader conclusions about this May-June 2021 project. Cure53 elaborates on the
general impressions and reiterates the verdict based on the testing team’s observations
and collected evidence. Tailored hardening recommendations relevant to the 1Password
B5 complex are also incorporated into the final section.
Cure53, Berlin · 07/29/21 3/20
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Penetration-Tests & Code Audits against 1Password B5 Web Application
◦ WP1: 1Password B5 web application UI and client-side parts with focus on
“integration” features for business accounts
▪ 1Password B5:
• https://1pw14example.b5test.com/integrations/
▪ 1Password SCIM Bridge:
• https://1pw14example.op-scim-demo.com/
▪ 1Password Connect-Server:
• http ://localhost:8080
▪ Related CLI features and attack surface
◦ WP2: 1Password B5 web backend with focus on “integration” features for business
accounts, written predominantly in GoLang
▪ Pentest & audit of the 1Password CLI for B5 (“op”)
▪ Pentest & audit of the Secrets Automation
▪ Pentest & audit of the SCIM bridge
▪ Pentest & audit of Events streaming
◦ Test-user-accounts were created by Cure53
◦ Vaults used for testing:
▪ https://1pw14example.b5test.com/home
▪ https://1pw142cure53.b5test.com /
◦ Test-supporting material was shared with Cure53
◦ All relevant sources were shared with Cure53
◦ Server & CLI binaries for several platforms were shared with Cure53
Cure53, Berlin · 07/29/21 4/20
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in chronological order rather than by their
degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. 1PW-14-001) for the purpose of facilitating any
future follow-up correspondence.
1PW-14-002 WP2: DoS on SCIM bridge via Groups route (Low)
During the assessment of the 1Password SCIM bridge server, the discovery was made
that the server suffers from a Denial-of-Service issue. The implemente