Tailscale SSH forwarding vulnerability lets compromised devices gain server root
Security researcher Erica Windisch published an 11-issue report, "Tailworm," on Oct 25 about Tailscale and headscale. It claims that in a lab environment, an attacker controlling one device approved to reach a target, using Tailscale SSH port forwarding, can gain root on the target server. As of Oct 26 there is no CVE or fixed version.
Tailscale SSH forwarding flaw could let a compromised device gain server root
Security researcher Erica Windisch published an 11-issue report on Tailscale and headscale titled "Tailworm" on October 25. The report claims that in a lab environment, an attacker who controls a device permitted to connect to a target can obtain root privileges on the target server by exploiting Tailscale SSH port forwarding; the tests were not conducted against real networks. As of October 26, there is no CVE or fixed version.
Tailscale says it is confirming the affected configurations and does not currently recommend that all users disable Tailscale SSH. The report recommends tightening access rules, authorizing by individual source device and target device, and disabling SSH port forwarding where feasible.
Source: The Hacker News | CloudNavi