Tailscale fixes SSH flaws allowing lateral movement within tailnets

Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on other machines that are part of it.

“Based on our investigation, an attacker could reach only machines the tailnet policy file already permitted SSH connections to,” said Mike Shaver, VP of Engineering at Tailscale.

About Tailscale and Tailscale SSH

Tailscale lets people and organizations link their computers, phones, servers and other devices into a single private network (aka “tailnet”), so they can reach one another securely from anywhere as if they were on the same local network. The solution uses the WireGuard communication protocol to encrypt and carry the data.

Users install the Tailscale app on each device and sign in with an existing account, such as Google or Microsoft, and the software handles the encrypted connections between them without complicated router or firewall configuration.

Home users usually use it to access files, media servers or security cameras while away. Businesses use it to give employees and systems controlled access to internal resources without exposing them to the public internet.

Tailscale also provides a built-in SSH server, which allows users to control a remote machine by typing commands to it. Tailscale SSH uses the identities already tied to users’ Tailscale accounts, along with access policies set by administrators, to decide who can connect to which machines.

This feature is helpful for remotely fixing a home server or restarting something that stopped working. Organizations also use it to allow staff to manage company computers without exposing them to the internet.

The SSH server is reachable only from devices inside the person’s or the organization’s tailnet.

About the vulnerabilities

On October 23, security researcher Erica Windisch of Cyberdione Labs published a report detailing vulnerabilities she discovered in Tailscale SSH and other Tailscale features, and collectively dubbed “Tailworm”.

Exploitation of the SSH issues hinges on an attacker having already compromised one approved device in a tailnet. From there, the attacker can use Tailscale SSH to gain root-level control of other servers, though only those the network’s policy lets that device connect to. They can also steal the keys used to enroll new devices and use them to add a rogue machine that appears legitimate.

In lab tests, the researcher claimed, this access could spread automatically from device to device, but Tailscale disputes the “worm” label. “Instead, this would be better described as lateral movement limited to connections allowed by a tailnet policy file,” Shaver noted.

The report also describes:

• A flaw in Conn25, a next-generation app-connector feature that is still in pre-production, which Shaver says will be fixed before its release.
• Denial-of-service issues that would let anyone on the internet crash self-hosted implementations of the Tailscale control server or prevent new devices from joining the network.

What to do?

The company fixed four vulnerabilities (1, 2, 3, 4), including the Tailscale SSH issue, and shipped the fixes in Tailscale v1.104.4.

Users are advised to upgrade to it and to review their Tailscale SSH policies, “to make sure access is limited to the users and devices that need it”, and to consider switching on Tailscale SSH’s Check mode for sensitive systems, so those can be accessed only after an additional authentication check is passed.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!