Tailscale is on the verge of releasing a crucial update to its client, aiming to resolve privilege escalation vulnerabilities identified in its SSH service. Over the weekend, these flaws were unexpectedly disclosed, prompting urgent action from the company.
Providing a mesh VPN solution using the WireGuard protocol, Tailscale connects devices and services within an organization through a secure, peer-to-peer network. The recently identified vulnerabilities, collectively named ‘Tailworm,’ were highlighted in a report by Cyberdione Labs, which outlined 11 security issues affecting Tailscale’s client version 1.104.2 and the headscale control server version 0.29.5, the latter being an open-source server option for organizations.
Understanding the Tailworm Vulnerabilities
The disclosure of the Tailworm vulnerabilities was made public before Tailscale could issue patches, causing a stir on social media. Cyberdione Labs defended their decision by emphasizing the need for rapid awareness to expedite the remediation process. Among the vulnerabilities, six are considered high severity, with four specifically affecting Tailscale SSH, which relies on device identity and network policy rather than traditional authentication methods.
The report points out that Tailscale SSH performs certain forwarding operations using root privileges, which could potentially be bypassed. As demonstrated in lab tests, an attacker could exploit these SSH vulnerabilities to gain root access on target servers and steal keys, allowing unauthorized devices to join the network. This initial access might be achieved through phishing, vulnerable applications, or malicious software.
Implications and Immediate Recommendations
Researchers also noted that these SSH vulnerabilities are ‘wormable,’ meaning they could enable automated attacks to spread quickly across servers authorized for SSH access, without needing user interaction. Additionally, the report addressed weaknesses in other Tailscale features, such as the experimental app connector and Serve feature, which could expose internal networks and cloud metadata services to unauthorized access.
Responding to these findings, Tailscale’s VP of Engineering, Mike Shaver, explained that the company was already investigating the issues when the report surfaced. He clarified that the vulnerabilities primarily affect authorized connections, emphasizing that their potential impact depends on SSH access configurations.
Patch Release and Future Outlook
Tailscale has announced that fixes for most issues are underway, with plans to release a patched client soon after thorough testing. They aim to provide a comprehensive security advisory and technical write-up following the update. As of Tuesday, October 27, several fixes have been integrated into Tailscale’s public code repositories, although they have not yet been included in a formal release.
In the interim, Tailscale advises organizations to review and modify their SSH access policies, particularly by disabling SSH forwarding where unnecessary, to mitigate the risk of serious vulnerabilities. While there have been no reports of real-world exploitation, the company remains proactive in ensuring user security.
Related news highlights the importance of timely patching, as seen with recent critical flaw resolutions from other tech giants like HPE and Microsoft.
