Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
[deleted]
CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
31–40 of 147 posts
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#32Earlier quoted context omitted.
Windows from W10 onwards has Unix sockets too.
The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.
Yes, but their existing TCP implementation wouldn't have been doing any auth either. So presumably they don't need it.
(I don't know anything about Tailscale so I'm just going on first principles.)
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#33Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…
[deleted]
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#34Releasing a patch and a detailed write-up on the same day seems like a bit of an unfortunate choice, especially for a WTF!! vulnerability like this. In software that doesn't auto-update, no less...
Especially as the fixes seemingly have been going into their public GitHub branch for days, since the report. I wonder if that was a conscious choice or negligience, maybe I'm missing something? I would expect these to be released as patches/merged in when the vulnerability is published, like a lot of other security-critical open source software does it.
The researcher released the writeup. The researcher doesn't work for Tailscale. The researcher doesn't release the patch.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#35I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost. Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.
Looks like it might be this? https://github.com/tailscale/tailscale/commit/976e88d430e0c5...
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#36Earlier quoted context omitted.
The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.
Yes, but their existing TCP implementation wouldn't have been doing any auth either. So presumably they don't need it. (I don't know anything about Tailscale so I'm just going on first principles.)
Didn't the article say they use netstat to do some checks?
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#37I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost. Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.
Looks like it might be this? https://github.com/tailscale/tailscale/commit/976e88d430e0c5...
There were a number of changes: https://github.com/tailscale/tailscale/commits/v1.32.3
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#38> If you visit my website, I am granted the honour and the privilege of executing arbitrary Javascript on your computer.
>
> This is a pretty bad idea
This is why I disable javascript by default, but I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible.
Edit: I don't mean to hate on the author, the content of the article is really interesting!
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#39Earlier quoted context omitted.
Windows from W10 onwards has Unix sockets too.
The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.
[co-author of the research here]
They actually approximate this functionality in the Windows implementation: It checks netstat to enforce that incoming TCP connections are from the expected Windows user! https://github.com/tailscale/tailscale/blob/2a991a3541ae5d56...
That's why we were happy with the solution they implemented as a stopgap, until they could switch to named pipes (which there is now an open PR for).
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#40> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…
> Anything other than an immediate response would have been akin to lighting their company on fire and walking away. Have we forgotten Zoom, who reinstalled itself secretly on user machines with an RCE-vulnerable server, which they described as “working as intended?” They’re still wildly popular today with organizations despite the insane lack of regard for security and their users’ safety. Mistakes happen. I applaud…
I would caution against grading on a curve