Recent revelations have exposed significant vulnerabilities within Tailscale’s SSH implementation, potentially allowing a compromised device to gain root access to other networked servers. These findings were outlined in a report titled ‘Tailworm’ by Erica Windisch of Cyberdione Labs, detailing the risks associated with unpatched flaws in Tailscale’s software.
Understanding the Vulnerabilities
According to the report, the attack scenario requires Tailscale SSH to be configured with port forwarding enabled and an attacker already in control of a device permitted by network access rules. Windisch’s tests, conducted on Tailscale version 1.104.2 and headscale version 0.29.5, demonstrated how these vulnerabilities could be exploited.
Windisch’s report clarifies that the tests were performed in a laboratory environment, not on real-world networks. Despite the lack of an official security bulletin or CVE identifier from Tailscale, the company acknowledged the report and is actively assessing the affected configurations.
Technical Insights and Responses
The report highlights that Tailscale SSH operates differently from traditional SSH servers, relying on device identification rather than user credentials for access. This unique setup eliminates the need for stolen passwords or keys, requiring only an initial foothold, which can be obtained through various attack vectors such as phishing or software vulnerabilities.
Tailscale’s Vice President of Engineering, Mike Shaver, has stated that the company is examining the vulnerabilities with external security experts and is not currently recommending disabling Tailscale SSH. Forwarding settings vary across platforms, with the hosted service allowing rule-based disabling, unlike the self-hosted headscale version.
Mitigation Strategies and Future Outlook
Administrators are advised to review and tighten Tailscale SSH access rules, limiting them to specific device-to-target pairs. Disabling SSH port forwarding where possible, especially on the hosted service, and removing unnecessary app connector permissions are key steps in mitigating the risks.
Tailscale suggests enabling SSH check mode to add a layer of authentication prior to session initiation and recommends regular automatic updates to stay ahead of potential threats. The company continues to work on comprehensive fixes to address these and other identified security issues.
As the cybersecurity landscape evolves, the importance of proactive security measures and timely patches cannot be overstated. Organizations using Tailscale should remain vigilant, ensuring their networks are configured to minimize exposure to these vulnerabilities.
