A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the
    Tailscale daemon `tailscaled`, which can then be used to remotely execute code. In the Tailscale Windows
    client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in
    cleartext with no Host header verification. This allowed an attacker-controlled website visited by the
    node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client,
    including changing the coordination server to an attacker-controlled coordination server. An attacker-
    controlled coordination server can send malicious URL responses to the client, including pushing
    executables or installing an SMB share. These allow the attacker to remotely execute code on the node. All
    Windows clients prior to version v.1.32.3 are affected. If you are running Tailscale on Windows, upgrade
    to v1.32.3 or later to remediate the issue. (CVE-2022-41924)

  - A vulnerability identified in the Tailscale client allows a malicious website to access the peer API,
    which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API
    was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind
    DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the
    client, including accessing the node’s Tailscale environment variables. An attacker with access to the
    peer API on a node could use that access to read the node’s environment variables, including any
    credentials or secrets stored in environment variables. This may include Tailscale authentication keys,
    which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to
    learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version
    v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue. (CVE-2022-41925)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability identified in the Tailscale client allows a malicious website to access the peer API,
    which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API
    was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind
    DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the
    client, including accessing the node’s Tailscale environment variables. An attacker with access to the
    peer API on a node could use that access to read the node’s environment variables, including any
    credentials or secrets stored in environment variables. This may include Tailscale authentication keys,
    which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to
    learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version
    v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue. (CVE-2022-41925)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e0f26ac5-6a17-11ed-93e7-901b0e9408dc advisory.

  - Tailscale team reports: A vulnerability identified in the Tailscale client allows a         malicious     website to access the peer API, which can then be used         to access Tailscale environment variables.
    (CVE-2022-41925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
426114	Alpine: multiple tailscale packages: security update to 1.32.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
426114	Alpine: multiple tailscale packages: security update to 1.32.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
418051	SCA: security update for tailscale.com/cmd (GHSA-qccm-wmcq-pwr6)	Tenable Cloud Security	SCA Checks	Local	high
418051	SCA: security update for tailscale.com/cmd (GHSA-qccm-wmcq-pwr6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
407315	Alpine: multiple tailscale packages: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
407315	Alpine: multiple tailscale packages: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
168042	FreeBSD : tailscale -- Security vulnerability in the client (e0f26ac5-6a17-11ed-93e7-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2022-41925

high

Tenable Plugins

critical

critical

high

high

high

high

high