Tailscale SSH Vulnerability Allowed Root Access
Insecure argument handling in Tailscale SSH permitted root access.
1Introduction
A security vulnerability in Tailscale SSH allowed root user access. This flaw originated from improper argument handling on Linux platforms, violating ACL policies.
2Root Cause
Tailscale SSH accepted usernames with a leading '-' character. These usernames were passed as arguments to the getent command on Linux, leading to root access.
3Impact of the Vulnerability
When a user connected with the username '-i', the getent command printed the entire passwd file starting with the root user, opening a root session.
4Who Was Affected?
Users of Tailscale SSH on Linux servers relying on autogroup:nonroot restrictions in ACLs were affected by this vulnerability.
5Solution
Tailscale SSH now rejects usernames with leading '-' characters. This security vulnerability has been fixed in Tailscale version 1.98.9 and later.
6What You Need to Do
If you use Tailscale SSH, it is recommended to upgrade to Tailscale version 1.98.9 or newer.
7Credits
We would like to thank Anthropic and Ada Logics for reporting this issue.
8Other Vulnerabilities
Other security vulnerabilities were identified in Tailscale, including HTTP requests locking the CPU and Services allowing access to loopback listeners.
9HTTP Request Issue
Tailscale Serve and Funnel could lock the CPU when handling HTTP requests that did not reach the root path. This issue was fixed in Tailscale 1.98.9.
10Services Issue
Tailscale Services allowed access to loopback listeners on non-advertised ports. This issue was fixed in Tailscale 1.98.9.
11UID Issue
Tailscale SSH allowed users to be addressed by UID, bypassing root restrictions. This issue was fixed in Tailscale 1.98.9.
12Conclusion
These security vulnerabilities in Tailscale underscore the importance of keeping software up to date for system administrators.
Original article: Hacker News: Front Page — Tailscale SSH'de Güvenlik Açığı Kök Erişimine İzin Verdi