Tailscale is getting ready to ship a client update that addresses privilege escalation weaknesses in Tailscale SSH. Details of the bugs went public over the weekend.
Tailscale provides a mesh VPN service that uses the WireGuard protocol to connect an organization’s devices and services over a private, peer-to-peer network.
The Tailscale vulnerabilities, dubbed Tailworm, are described in a report from Cyberdione Labs. It lists 11 findings affecting version 1.104.2 of the Tailscale client and version 0.29.5 of headscale, an open source control server that organizations can host themselves.
Cyberdione Labs published the report before any patches were available, drawing criticism on social media, though the researchers argued that rapid awareness would speed up remediation.
Six of the findings are rated high severity, and four of them concern Tailscale SSH, which grants access based on device identity and network policy instead of passwords or keys.
According to the Tailworm report, Tailscale SSH performs some forwarding operations with root privileges, and the safeguards meant to restrict them can be bypassed.
An attacker who has compromised one device could exploit this against any server that device is permitted to reach over Tailscale SSH, as long as the access rule allows forwarding. In lab tests, this resulted in root access on target servers and the theft of keys that can be used to add rogue devices to the network.
That initial foothold could come from common methods such as phishing, a vulnerable web application or a malicious software package.
Researchers showed that these SSH flaws are wormable. Since no user credentials are involved, an automated attack chaining these bugs moved from machine to machine across every server the policy granted SSH access to, at under a second per hop and with no user interaction.
The report also describes flaws in an experimental app connector feature, the Serve feature, headscale and the client’s relay component that could be exploited to reach cloud metadata services and internal networks while bypassing access rules, expose a node’s administrative interface to remote peers, or cause denial-of-service (DoS) conditions.
Tailscale says fixes are close
Responding on Reddit, Tailscale VP of Engineering Mike Shaver said the company was already running its own investigation, with input from outside security specialists, when the report came in.
“Most of the issues we’ve identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do,” Shaver said.
“While it’s a serious concern, it isn’t the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured,” he added.
In an update shared on Monday, Tailscale said fixes were in place for most of the issues and that it was aiming to release a patched client by the end of Tuesday, October 27, pending testing. A security advisory and a technical write-up will follow once the update is out.
The Tailworm report, updated on Tuesday, says fixes for several findings have landed in Tailscale’s public code repositories. None had made it into a numbered release at that point.
“Based on our current assessment, we’re not recommending that everyone disable Tailscale SSH,” the vendor said.
Until the patch arrives, Tailscale advises organizations to review their SSH access policies and disable SSH forwarding where it isn’t needed, which it says mitigates several of the more serious findings.
Neither Tailscale nor the Tailworm report mentions in-the-wild exploitation.
Related: HPE Patches Dozens of Critical Flaws in Networking Products
Related: Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Related: PHP2Shell Exploitation Moves From Probes to Working Shells
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
