Live data from Hacker News

CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

emily.id.au

41–50 of 147 posts

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#41
post #38

> If you visit my website, I am granted the honour and the privilege of executing arbitrary Javascript on your computer. > > This is a pretty bad idea This is why I disable javascript by default, but I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible. Edit: I don't mean to hate on the author,…

> I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible.

You seem to be correct. I found a single tag in the source, with the following code:

    (() => {
        let v = localStorage.getItem("color-scheme"),
            a = window.matchMedia("(prefers-color-scheme: dark)").matches,
            cl = document.documentElement.classList,
            setColorScheme = v => (!v || v === "auto" ? a : v === "dark") ? cl.add("dark") : cl.remove("dark");
        setColorScheme(v);
        window.setColorScheme = v => {
            setColorScheme(v);
            localStorage.setItem("color-scheme", v)
        };
    })();
Though I don't see what's the point of this since the "light" theme, as you've pointed out, is completely illegible.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#42
post #38

> If you visit my website, I am granted the honour and the privilege of executing arbitrary Javascript on your computer. > > This is a pretty bad idea This is why I disable javascript by default, but I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible. Edit: I don't mean to hate on the author,…

That’s a selective quote…

> This is a pretty bad idea, but luckily even the web browser has its limits.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#43
post #21

Earlier quoted context omitted.

Yes. I got a (concise, well-written) email this morning with the following: > Am I affected? > Yes. Your tailnet has at least one Windows node running a version of Tailscale prior to v1.32.3.

I received this email as well, I probably should have clarified to say that it would be interesting to know if any of this was ever actively exploited. I assume this hasn't happened, considering the sentence in their report, but this is a client vulnerability, so logs may not have reached their servers(I know nothing about their telemetry setup or what is actually logged, which is why I mentioned that a blog post abo…

1) they probably don't get notify 2) they also have interest to say no if isn't being exploited publicly even if they are searching cases internally. In any case the response feels solid most companies will try force update whit vulnerability a and not disclose what the problem was and then blame the public for not have the software update, this giveme security about the compaby, it's also problematic because it drains the the time of the host to update their systems.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#44
post #38

> If you visit my website, I am granted the honour and the privilege of executing arbitrary Javascript on your computer. > > This is a pretty bad idea This is why I disable javascript by default, but I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible. Edit: I don't mean to hate on the author,…

[deleted]

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#45
> If you run non-HTTPS web services on your Tailnet, and those services are unauthenticated or rely on Tailscale for authentication, implement an allowlist of expected HTTP Host headers to prevent malicious Javascript from accessing these services.

In my opinion, this should be done not only for non-HTTPS services, but for all services: the "default" virtual host (used where there is no Host header, or when it has an unexpected value) should have nothing except a static 4xx error page. This not only avoids DNS rebinding attacks, but also avoids automated attacks in which the attacker doesn't know the correct hostname for the service (mostly automated scans for vulnerable PHP scripts and similar).

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#47

Releasing a patch and a detailed write-up on the same day seems like a bit of an unfortunate choice, especially for a WTF!! vulnerability like this. In software that doesn't auto-update, no less...

Looking at the timeline, it looks like Tailscale opted to allow for public release on the day of the patch:

> Sat 19 November: Coordinated Disclosure time proposed by Tailscale, accepted by us, Tailscale shares planned Security Bulletins and blog post > Tue 22 November, 5:06AM: Blog draft shared with Tailscale (a bit last minute, sorry!!!) > Tue 22 November, 7:00AM: Coordinated disclosure time

Because the code is open source anyway, I'm guessing they assume attackers would see the announcement of a vulnerability, browse the recent pull requests and figure it all out themselves anyway. Delaying publishing of the details saves maybe a few days of exposure to risk for motivated attackers, especially as the author seems to have done her work together with one other person in just over a week.

They've also sent out emails it seems, so people know they should update ASAP and why. With the extremely limited amount of people running Tailscale (and the even smaller subgroup running it on Windows specifically) I don't think it's an attack hackers will rush to roll out. Mitigations also exist (i.e. block access from the browser to 100.100.100.100) so even in situations where you cannot update you can protect yourself.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#49
post #34
post #16

Earlier quoted context omitted.

Especially as the fixes seemingly have been going into their public GitHub branch for days, since the report. I wonder if that was a conscious choice or negligience, maybe I'm missing something? I would expect these to be released as patches/merged in when the vulnerability is published, like a lot of other security-critical open source software does it.

The researcher released the writeup. The researcher doesn't work for Tailscale. The researcher doesn't release the patch.

    > Coordinated Disclosure time proposed by Tailscale, accepted by us, Tailscale shares planned Security Bulletins and blog post

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#50
post #36

Earlier quoted context omitted.

Yes, but their existing TCP implementation wouldn't have been doing any auth either. So presumably they don't need it. (I don't know anything about Tailscale so I'm just going on first principles.)

Didn't the article say they use netstat to do some checks?

Ah yes, the new link says that. The old link didn't that detail.
Post reply on HN