Tailscale has rolled out version 1.104.4 to address critical vulnerabilities in its integrated SSH server, which could potentially permit attackers to access root-level services and files on other servers. These vulnerabilities arise from the way Tailscale SSH manages network connection forwarding, a task executed by the Tailscale background process with root privileges. To exploit these flaws, an attacker must already have control over a device that the network’s access policies allow to open an SSH session to the targeted server, with connection forwarding enabled in that policy.
Details of the Security Flaws
The vulnerabilities, detailed in a report named Tailworm by Erica Windisch of Cyberdione Labs, highlight issues in the Tailscale client and the self-hosted headscale control server. Notably, Tailscale SSH authenticates connections based on device identity and network policy files rather than passwords or keys, meaning an attacker requires only a foothold on a trusted device. While these vulnerabilities do not allow unauthenticated access to arbitrary Tailscale SSH servers, they do permit attackers to access machines already permitted by the policy file.
The vulnerabilities are specific to Linux and the open-source macOS build, although the attacker’s device can operate on any platform. The core issue lies in socket forwarding. When an authorized SSH session forwards a connection to a Unix socket on the server, Tailscale’s process checks the path but operates with root privileges. A timing manipulation could allow an attacker to alter the path post-verification, circumventing the intended restrictions on socket access.
Mitigation and Recommendations
With the release of version 1.104.4, Tailscale has modified the SSH server to execute forwarding under the logged-in user’s privileges rather than as root, relying on the operating system’s file permissions rather than its own path checks. This update includes resolutions for four security bulletins, including flaws that could lead to root-only socket access and potential server memory exhaustion.
To mitigate these risks, Tailscale users are advised to update to version 1.104.4 or later. For those unable to update immediately, disabling SSH forwarding can be achieved by setting a specific environment variable. Additionally, reviewing SSH access policies to ensure only necessary users and devices have access is recommended. For heightened security, employing SSH check mode, which necessitates re-authentication before session initiation, is suggested for sensitive systems.
Further Implications and Industry Response
Erica Windisch’s report also provides insights into the broader implications of these vulnerabilities. While Tailscale refutes the notion of a ‘wormable’ threat, Windisch’s tests demonstrated potential for rapid spread across devices within a network. The report suggests strict access rule configurations and hardware-bound device keys as effective measures to prevent such propagation.
The vulnerabilities are currently without CVE identifiers or severity ratings, and the oldest affected versions remain unspecified. Tailscale has acknowledged receiving the report shortly before its publication and has since been actively addressing the security concerns. As of now, there is no evidence of real-world exploitation, and proof-of-concept code has been shared exclusively with Tailscale’s security team.
This incident underscores the continued importance of proactive security measures and timely updates in the face of evolving cyber threats. Tailscale’s swift response highlights the company’s commitment to safeguarding its users’ network environments.
