Security Flaws in Tailscale SSH Could Allow Root Access via Compromised Devices

A security researcher has reported that a compromised device on a Tailscale network can be exploited to gain root access to other reachable servers. This vulnerability requires Tailscale SSH to be configured for port forwarding and an attacker to control a device that the network’s access rules allow to connect to the target.

The findings were published on October 25 in a report titled Tailworm by Erica Windisch of Cyberdione Labs. Windisch conducted tests on Tailscale version 1.104.2 and headscale version 0.29.5, a self-hosted server alternative to Tailscale’s service, over three days in a controlled environment.

The report details tests on the software rather than real-world attacks. As of the publication date, Tailscale had not issued a security bulletin, a CVE identifier, or a fixed version.

Mike Shaver, Tailscale’s vice president of engineering, stated on Reddit that the company had received the report and was investigating the same areas with external security experts. He noted that Tailscale is still determining which configurations are affected and is not advising users to disable Tailscale SSH.

Tailscale SSH operates differently from traditional SSH servers. Instead of verifying a user’s password or key, it identifies the device, and a single access rule determines whether that device can open an SSH session to a target. This means that the attack does not require stolen passwords or keys, only an initial foothold on one device, which can be obtained through various means such as exploiting a vulnerable web application, phishing, or using stolen login details.

Windisch demonstrated the vulnerability in stages during testing. Using standard SSH port forwarding, an ordinary session allowed the root-level Tailscale process to connect to a system socket restricted to root access, leading to immediate root access and the ability to read the system password file without needing administrator rights.

Another method bypassed a safety check intended to limit file access during forwarding by racing the system between the file path check and its use. This method captured a key used for enrolling new devices, allowing the attacker to join their own machine to the network as a trusted server. This last method was successful only on networks without Tailscale’s Tailnet Lock feature enabled.

Windisch described the overall result as “wormable,” indicating that one compromised device could potentially spread to every device allowed by the access rules, without requiring passwords, stolen keys, or user intervention. The report states, “the mesh converts one ordinary foothold into fleet-wide privileged access at machine speed,” although this spread was measured in a lab and not observed on actual networks.

The report identified two factors that limited the spread: access rules defined as single source-to-destination pairs and device keys linked to hardware like a TPM or Secure Enclave.

Some researchers have questioned the “wormable” characterization, while others have acknowledged the seriousness of the root-access finding. The SSH issue is one of eleven findings in the report, which also examines Tailscale’s app connectors and the DERP relay used between devices. Windisch noted that while the SSH privilege escalation is concerning, the app connector finding could be more impactful for some organizations.

Windisch characterized the disclosure as “reported but not coordinated,” mentioning on Ycombinator HN that at least one commenter deemed it irresponsible to publish without first reporting to Tailscale. In response to inquiries from The Hacker News, Windisch clarified that she had provided Tailscale with a copy of the report and proof-of-concept code before the public release.

Recommended Actions

As there is currently no patch available, users should modify their Tailscale SSH and related feature configurations. The report and Tailscale’s recommendations largely align:

• Review Tailscale SSH access rules, ensuring they are defined as single source-to-destination pairs.
• Disable SSH port forwarding where possible.
• Remove app connector permissions from devices that do not require them.
• Eliminate any tailscale serve forward that points to a Unix socket.
• Enable node-key expiry to prevent a stolen device key from remaining valid indefinitely.
• If a device is compromised, delete it from the control plane.

Tailscale also recommends enabling SSH check mode, which adds a login step before a session starts, and enabling automatic updates. However, check mode does not resolve the privilege escalation issue; it merely adds an additional barrier.

Source: The Hacker News