Tailscale SSH Vulnerability Allowed Root Access
Critical security flaw in Linux systems permitted unauthorized root access via SSH.
1Critical SSH Vulnerability
A security flaw in Tailscale SSH allowed unauthorized root access on Linux systems. Malicious users could gain admin privileges using specially formatted usernames. This vulnerability specifically bypassed ACL policies, posing serious security risks.
2Technical Details of the Flaw
The issue stemmed from misuse of leading '-' characters in usernames. Arguments like '-i' were passed to getent command, enabling reading of the entire passwd file and root session access. This exploited a vulnerability in Linux command argument processing logic.
3Affected Systems
All Tailscale SSH users on Linux servers relying on autogroup:nonroot restrictions were affected. This critical vulnerability existed in all Tailscale versions prior to 1.98.9, especially dangerous in multi-user environments.
4Attack Scenarios
An attacker could connect with '-i' username to obtain root privileges. This worked even when explicitly denied in ACLs, potentially leading to data breaches and system compromises, particularly on shared servers.
5Solution and Patch
Tailscale fixed the issue in version 1.98.9. The new version rejects usernames with leading dashes. Immediate upgrade is critical. System administrators should also review their ACL policies for additional protection.
6Alternative Access Methods
The vulnerability wasn't limited to SSH. Tailscale Services also allowed unauthorized access to loopback services. Version 1.98.9 fixes this by implementing proper port filtering, only allowing access to defined ports.
7UID Privilege Escalation
Another flaw allowed access via UID values. Users connecting as '0@host' could gain root access. The new version completely blocks numeric UIDs, accepting only usernames for authentication.
8Unix Socket Vulnerability
Tailscale Serve had another issue permitting unauthorized access to Unix sockets. Non-root users could access root-only sockets (like Docker socket), potentially leading to container escape scenarios.
9Denial of Service Risk
Another HTTP request vulnerability could completely consume CPU with a single malicious request, causing service outages. The new version fixes this by rejecting non-absolute paths.
10Security Audit Process
Tailscale discovered these vulnerabilities thanks to security researchers like Anthropic and Ada Logics. The company's quick resolution and transparent disclosure demonstrate its security-focused approach. Users should monitor security bulletins.
11Upgrade Instructions
Users must upgrade Tailscale clients and servers to version 1.98.9 or higher. Linux servers with SSH access should be prioritized. Post-upgrade, verify ACL policies and user permissions for complete security.
12Cybersecurity Lessons
This incident highlights the importance of argument sanitization and input validation. System designers should better analyze how user inputs might be interpreted. Tailscale's rapid response sets an example in vulnerability management.
Original article: Hacker News — Tailscale SSH'de Kök Erişimine İzin Veren Güvenlik Açığı