Tailscale vulnerabilities allowed DoS and unauthorized root access

Overview of Vulnerabilities

Tailscale reported two critical vulnerabilities: one affecting Tailscale Serve and Funnel through denial of service (DoS) and another concerning Tailscale SSH, allowing unauthorized root access. Both vulnerabilities require immediate action from users running older versions of Tailscale.

Denial of Service Risk

The DoS vulnerability allows attackers to send malformed HTTP requests to nodes running Tailscale Serve or Funnel, causing a CPU core to spin indefinitely. This issue arises when the request path does not start with '/', resulting in an infinite loop without a timeout.

Unauthorized Root Access

The SSH vulnerability arises from Tailscale's acceptance of usernames with leading dashes. This allowed an attacker to connect using such a username and trigger commands that could access sensitive information. As a result, they could start a root session, violating access control lists.

Mitigation Steps

The vulnerabilities have been patched in Tailscale version 1.98.9 and users running affected versions are strongly encouraged to upgrade immediately. Organizations using Tailscale must ensure their systems are updated to avoid potential exploitation of these vulnerabilities.

Acknowledgements

Tailscale credited Anthropic and Ada Logics for identifying and reporting these vulnerabilities, which helped the company in ensuring their product's security.