Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

emily.id.au

Post reply on HN
Print view View original

61–70 of 147 posts

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#61

Post by ThePhysicist »

ferbivore wrote: post #13

Releasing a patch and a detailed write-up on the same day seems like a bit of an unfortunate choice, especially for a WTF!! vulnerability like this. In software that doesn't auto-update, no less...

Malicious actors will monitor patches and reverse-engineer them anyway, so probably better to make some noise in this case and make sure people update as fast as possible.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#63

Post by monocasa »

JJJollyjim wrote: post #39
monocasa wrote: post #30

Earlier quoted context omitted.

The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.

[co-author of the research here] They actually approximate this functionality in the Windows implementation: It checks netstat to enforce that incoming TCP connections are from the expected Windows user! https://github.com/tailscale/tailscale/blob/2a991a3541ae5d56... That's why we were happy with the solution they implemented as a stopgap, until they could switch to named pipes (which there is now an open PR for).

Huh, ok, that's not so bad then.

It feels like there could still be a TOCTOU issue there, but it'd be difficult to use.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#64

Post by afhammad »

adam_arthur wrote: post #62

Does this mean we won’t get spammed with tailscale articles every day now?

This means you will see more of Tailscale.

Vulnerabilities are inevitable, the actions taken in the hours (ideally) and days following the discovery is what matters most.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#65

Post by judge2020 »

cesarb wrote: post #45

> If you run non-HTTPS web services on your Tailnet, and those services are unauthenticated or rely on Tailscale for authentication, implement an allowlist of expected HTTP Host headers to prevent malicious Javascript from accessing these services. In my opinion, this should be done not only for non-HTTPS services, but for all services: the "default" virtual host (used where there is no Host header, or when it has an…

In addition, it's basically required if you're using a reverse proxy service, eg. Cloudflare or Akamai. CF websites have been found via Shodan or Censys because site info is left open via https ://[ip]:443.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#66

Post by erdaniels »

ghuntley wrote: post #2

Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!

can you DM me her email? I can't find it anywhere and I'd love to start a chat with on a security position at my work.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#67

Post by acuteaura »

tailspin2019 wrote: post #7

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…

As the reporting party of the much less severe (and much less interesting) TS-2022-003[1] I can confirm that vendor interaction is also swift when not responding would not light the company on fire. In fact there were several other vendors that were affected that have yet to mitigate it.

[1]: https://notes.acuteaura.net/posts/github-enterprise-security...

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#68

Post by er4hn »

ghuntley wrote: post #2

Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!

where does she say she is looking for an employer? Would be worthwhile to start a conversation with her.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#69

Post by snake_plissken »

The concept of DNS rebinding and DNS records pointing to a private/localhost IP address is particularly interesting and I remember when I first came across it in the wild. It's not exactly re-binding in the classic attack sense described in the article: some US sportsbooks make you download a geolocation service that verifies your location in order to place bets. The sportsbook's front end communicates with it through a DNS record pointing back to 127.0.0.1, and opens up a WebSocket to talk to the service. I imagine the WebSocket is used to bypass the same-origin policy but perhaps someone more knowledgeable can speak to that.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#70

Post by maxmcd »

erdaniels wrote: post #66
ghuntley wrote: post #2

Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!

can you DM me her email? I can't find it anywhere and I'd love to start a chat with on a security position at my work.

No post body was provided.
Post reply on HN