Tailscale SSH: eleven flaws, including a shortcut straight to root

On Tuesday, October 27, Bleeping Computer laid out eleven vulnerabilities found by Cyberdione Labs. They affect Tailscale, the mesh VPN built on WireGuard, and headscale, the self-hosted control server. The researchers named the whole set Tailworm, since a bug apparently needs a catchy name these days before anyone takes it seriously. At the time of publication, the article said none of the flaws had a fix yet. We have no second independent source, so everything below comes from that one article, which quotes both Tailscale and Cyberdione Labs.

The affected versions

The researchers reproduced every finding in a lab, on released and unmodified builds: Tailscale 1.104.2 and headscale 0.29.5. Those are the only versions the source names. It doesn’t list which earlier versions are affected, and it gives no version numbers for the fixes. So for now, nobody can honestly tell you that a particular update makes the problem go away. Cyberdione Labs says it published the details to speed up the fixes. Less reassuringly, the lab adds that the flaws didn’t take much effort to find.

Tailscale SSH, the worst of the bunch

The most serious problem reportedly sits in the SSH server built into tailscaled, which runs as root. It involves Unix socket forwarding (ssh -R or ssh -L). Path checks and file operations there would run with full root privileges, never dropping them, and would be open to race conditions. An ordinary session could then replace, connect to or delete privileged resources. Put simply, a guest gets to rearrange the furniture in root’s living room.

The reported consequences are serious: code execution as root on the targeted servers, theft of enrollment keys, and deletion of any file owned by root. A random stranger on the internet can’t pull this off, though. The attacker needs an approved device on the tailnet and an SSH policy rule. On headscale, forwarding would be granted automatically. On Tailscale’s hosted service, it depends on each rule.

Tailscale confirms these are serious issues, mostly involving privilege escalation. Someone who is already allowed to connect over Tailscale SSH could do more than the configured local user is allowed to. The company says exploitation depends on the permissions granted, the system configuration and other conditions. It is still working out which configurations are actually affected.

The other components affected

The remaining flaws affect other components:

• app connectors (conn25, experimental) would send traffic to destinations the attacker picks without checking network ACLs. That would expose cloud metadata, internal networks and, on Kubernetes, every service in the cluster;
• headscale could be flooded without authentication until it crashes in a loop and stops accepting new devices;
• the DERP client, which ships in every agent, could have its memory exhausted by a malicious relay;
• in tailscale serve, TCP forwarding to a Unix socket would skip the protection that HTTP requests get. It could expose the machine’s administration API to remote access.

What to do now

On Monday, Tailscale said it had received the report and expected to have fixes by the end of the day. The company isn’t asking all users to turn off Tailscale SSH. Until a patched release arrives, it recommends two steps:

• review your SSH access policies and limit them to the users and devices that really need them;
• if you don’t use SSH forwarding, add TS_SSH_DISABLE_FORWARDING=1 to the tailscaled service environment, then restart the service. This turns off forwarding, keeps Tailscale SSH running, and mitigates several of the flaws.

When patched versions of Tailscale and headscale come out, read their release notes to make sure they actually fix these flaws. Install them first on the machines where Tailscale SSH is enabled. If your headscale server can be reached from the internet, update it early too, because crashing it reportedly doesn’t require an account.

The patches depend on the vendors. Adding the environment variable takes one line and a restart, so you can do it before you log off tonight.