Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

emily.id.au

Post reply on HN
Print view View original

21–30 of 147 posts

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#21

Post by meibo »

ripley12 wrote: post #17
meibo wrote: post #5

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…

Yes. I got a (concise, well-written) email this morning with the following: > Am I affected? > Yes. Your tailnet has at least one Windows node running a version of Tailscale prior to v1.32.3.

I received this email as well, I probably should have clarified to say that it would be interesting to know if any of this was ever actively exploited. I assume this hasn't happened, considering the sentence in their report, but this is a client vulnerability, so logs may not have reached their servers(I know nothing about their telemetry setup or what is actually logged, which is why I mentioned that a blog post about their part of the procedure might have been nice).

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#22

Post by bradfitz »

arkadiyt wrote: post #8
meibo wrote: post #5

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…

edit: I stand corrected as pointed out by the replies below. Curious what logs they had to prove this! Original comment: > Do they have enough logs to reach out to people that were affected? It happens on the client, there are no server logs that Tailscale could check

Reconfiguring the local client daemon (tailscaled) is reported to Tailscale log servers so there's server-side evidence if it's exploited.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#23

Post by cmeacham98 »

arkadiyt wrote: post #8
meibo wrote: post #5

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…

edit: I stand corrected as pointed out by the replies below. Curious what logs they had to prove this! Original comment: > Do they have enough logs to reach out to people that were affected? It happens on the client, there are no server logs that Tailscale could check

> Curious what logs they had to prove this!

My guess is the client sends some kind of "goodbye" message when it gets reconfigured to another coordination server, and that message has enough information to determine if it originated from this attack.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#24

Post by more_corn »

jakedata wrote: post #6
mayakacz wrote: post #4

Earlier quoted context omitted.

Tailscalar here. The Windows client caches the current version for a while, so may not yet have v1.32.3 available on your device. In that case, you can still pull the latest release from http://pkgs.tailscale.com/stable .

Tailscale admin here, politely requesting client update push capability. Being able to see endpoint version is helpful, I will be suspending unpatched endpoints in the near future.

Seconded

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#25

Post by say_it_as_it_is »

I've read the description several times and find it hard to follow:

..an attacker-controlled website visited by the node..rebinds DNS for the peer API to an attacker-controlled DNS server making peer API requests in the client, including accessing the node’s Tailscale environment variables

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#27

Post by [deleted] »

tailspin2019 wrote: post #7

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…

[deleted]

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#28

Post by dang »

ghuntley wrote: post #2

Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!

That article has so much more information in it that I've changed the URL to that from https://tailscale.com/security-bulletins/#ts-2022-004. Thanks!

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#29

Post by dang »

amluto wrote: post #19

I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost. Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.

(This comment was in response to the original submission https://tailscale.com/security-bulletins/#ts-2022-004, which we've since changed)

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#30

Post by monocasa »

Arnavion wrote: post #20
amluto wrote: post #19

I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost. Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.

Windows from W10 onwards has Unix sockets too.

The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.
Post reply on HN