Penetration Test Report (RecurityLabs): 378.2203.Recurity Labs Report 1Password Windows Client v1.0

Recurity Labs GmbH
https://www.recurity-labs.com
1Password for Windows
Security Assessment
Project No. 378.2203
Report
FINAL
for
AgileBits Inc dba 1Password
4711 Yonge St., 10th Floor
Toronto, ON M2N 6K8
Canada
Report Highly Confidential Recurity Labs
378.2203 Page 1 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
Document Versions and Changes
Version Author Date Comment
0.1 Andreas Lindh 2022-09-09 Initial draft
0.2 Johan Rydberg Möller 2022-09-09 Additions
0.3 Lucas Humfeldt 2022-09-12 Technical review
0.4 Andreas Lindh 2022-09-12 Clarifications
0.5 Nico Lindner 2022-09-12 Editorial review
0.6 Florian Grunert 2022-09-29 Update after feedback from AgileBits
0.7 Nico Lindner 2023-02-01 Update after feedback from AgileBits
0.8 Nico Lindner 2023-02-03 Adding feedback from AgileBits to
chapters 3.1 and 3.2
0.9 Nico Lindner 2023-02-03 Commenting on the provided feedback
in chapters 3.1 and 3.2
1.0 Nico Lindner 2023-02-03 Final version based on v0.9
Report Highly Confidential Recurity Labs
378.2203 Page 2 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
Table of Contents
1 Executive Summary............................................................................................................5
1.1 Table of Findings..............................................................................................................6
1.1.1 Qualitative Severity Rating Scale..................................................................................6
2 Project Background.............................................................................................................7
2.1 Team................................................................................................................................7
2.2 Analyzed System..............................................................................................................7
2.3 Procedures.......................................................................................................................8
3 Findings in Detail...............................................................................................................10
3.1 Import Parser Quotation Injection...................................................................................10
3.2 Windows Hello Authentication Degradation....................................................................12
Report Highly Confidential Recurity Labs
378.2203 Page 3 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
Terms and Definitions
Term Definition
API Application Programming Interface
CSV Comma Separated Value
DoS Denial-of-Service
ID Identification
PIN Personal Identification Number
ZIP ZIP (compressed archive file format)
Report Highly Confidential Recurity Labs
378.2203 Page 4 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
1 Executive Summary
AgileBits requested consultation by Recurity Labs to perform a security review of 1Password
for Windows. The goal of the assessment was to target a set of new functions, as well as the
biometric authentication mechanism. Testers were given access to user accounts, source
code and documentation, and used multiple techniques to test these functions as thoroughly
as possible within the allotted time.
Two issues were noted during this test, neither of them with a risk rating higher than medium.
They consist of an observation regarding a possible degradation in the application's security-
level when biometric authentication is used, as Windows Hello (by default) allows for a
fallback authentication scheme consisting of a 4-digit pin code. The other issue concerns a
parsing error when importing CSV files, resulting in a potential leakage of sensitive
information to local users. In summary, no critical issues were discovered and the security of
the code base appears strong.
Report Highly Confidential Recurity Labs
378.2203 Page 5 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
1.1 Table of Findings
The following table summarizes the findings Recurity Labs made during the assessment. The
individual results were evaluated according to CVSSv3.11 on request by AgileBits. The
CVSSv3.1 vector used for the calculation can be found in section Overview of the respective
finding(s), detailed in the sub-chapters of section 3 of this document.
ID Description Chapter CVSS Severity
Findings in Detail
378.2203.1 Import Parser Quotation Injection 3.1 4.4 Medium
378.2203.2 Windows Hello Authentication Degradation 3.2 N/A N/A
1.1.1 Qualitative Severity Rating Scale
All CVSS scores can be mapped to the qualitative ratings defined in the table2 below:
CVSS Score Rating
0.0 None
0.1 - 3.9 Low
4.0 - 6.9 Medium
7.0 - 8.9 High
9.0 - 10.0 Critical
1 https://www.first.org/cvss/v3-1/
2 https://www.first.org/cvss/specification-document, chapter 5
Report Highly Confidential Recurity Labs
378.2203 Page 6 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
2 Project Background
Recurity Labs was tasked by AgileBits to perform a security review of 1Password for
Windows, focusing on a number of new features, as well as the biometric authentication
mechanism.
2.1 Team
The assessment was performed by Andreas Lind and Johan Rydberg Möller of Recurity Labs
between August 29th to September 09th, 2022.
2.2 Analyzed System
1Password for Windows was assessed in version 8.8.0, and was tested on Windows 11,
version 10.0.22000. The backend environment was b5test.
Source code was provided to the testers as a ZIP with the following sha256 hash:
6d4f21a1d780f89358e2cc25e48854c6a535de072bddcbc41b874ccc7931caf2
The following output from the tool cloc3 provides a high-level overview of the source code
made available:
github.com/AlDanial/cloc v 1.92 T=13.68 s (801.9 files/s, 111081.7 lines/s)
-----------------------------------------------------------------------------------
Language files blank comment code
-----------------------------------------------------------------------------------
JSON 4113 35 0 615620
Rust 1703 43809 43274 360069
TypeScript 969 12991 8317 98720
XML 1141 4[PII_REDACTED]9
Swift 655 9261 7554 50110
Kotlin 459 5291 1815 37315
YAML 30 3[PII_REDACTED]3
JavaScript 84 5589 4326 26034
Markdown 220 7702 0 25512
SCSS 325 3[PII_REDACTED]5
SVG 714 2 7 10614
TOML 254[PII_REDACTED]
HTML 28 370 21 3783
Go 38[PII_REDACTED]
C 5[PII_REDACTED]
Python 2[PII_REDACTED]
make 22[PII_REDACTED]
Ruby 27 343 49 1194
Jupyter Notebook 5 0 931 881
Bourne Shell 32 219 161 827
Svelte 18 119 0 739
Bourne Again Shell 30 211 215 705
Gradle 6 89 49 545
SQL 22 116 48 348
C/C++ Header 20 133 225 345
PowerShell 9 69 29 268
Objective-C 3 53 22 216
CSS 7 26 20 139
DOS Batch 2 23 2 61
Dockerfile 3 15 10 28
EJS 1 3 6 15
Properties 2 0 18 11
C# 1 0 0 7
CSV 1 0 0 3
3 https://github.com/AlDanial/cloc
Report Highly Confidential Recurity Labs
378.2203 Page 7 of 13
Recurity Labs GmbH
https://www.recurity-labs.com
Windows Resource File 1 0 0 1
ProGuard 1 3 18 0
-----------------------------------------------------------------------------------
SUM: 10972[PII_REDACTED]7 1349974
-----------------------------------------------------------------------------------
2.3 Procedures
The assessment focused on the access and protection of vaults and their contents, but also
on the security of the application from a design standpoint, in terms of input handling,
storage, and more. Please note that the backend API has not been in-scope for this review,
but has been considered as a vector for attacking the client, and has been utilized as such.
Prior to the assessment, AgileBits provided a list of features, which should be in-scope4. The
following is a listing of the in-scope features and a high-level representation of the review
tasks within the executed assessment.
• Data Import
Parsing of imported data, storage and filesystem interactions related to import and export
activities, vault and collection separation after and during imports.
• Secure file attachments
Access protection mechanisms related to secure file attachments, content parsing and
ren