Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

Summary: Researcher Erica Windisch of Cyberdione Labs published a report on October 25 called Tailworm describing lab tests against Tailscale version 1.104.2 and headscale version 0.29.5 in which one compromised device gained root on other reachable servers through Tailscale SSH port forwarding, without passwords or stolen keys. At publication Tailscale had issued no security bulletin, CVE, or fixed version, and on October 27 it said it had built fixes for most identified privilege-escalation issues and was targeting a release within 24 hours.
Bottom line: On headscale 0.29.5, forwarding cannot be disabled at all, so the report says every SSH grant there should be treated as giving root on the target. Windisch measured one compromised device spreading to every device the access rules allow in under a second per step, and the report's app connector finding could send traffic to a cloud metadata service that hands out server credentials.

Read the original at The Hacker News ↗