A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node’s Tailscale environment variables. An attacker with access to the peer API on a node could use that access to read the node’s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability identified in the Tailscale client allows a malicious website to access the peer API,
    which can then be used to access Tailscale environment variables. In the Tailscale client, the peer API
    was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind
    DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the
    client, including accessing the node’s Tailscale environment variables. An attacker with access to the
    peer API on a node could use that access to read the node’s environment variables, including any
    credentials or secrets stored in environment variables. This may include Tailscale authentication keys,
    which could then be used to add new nodes to the user’s tailnet. The peer API access could also be used to
    learn of other nodes in the tailnet or send files via Taildrop. All Tailscale clients prior to version
    v1.32.3 are affected. Upgrade to v1.32.3 or later to remediate the issue. (CVE-2022-41925)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e0f26ac5-6a17-11ed-93e7-901b0e9408dc advisory.

  - Tailscale team reports: A vulnerability identified in the Tailscale client allows a         malicious     website to access the peer API, which can then be used         to access Tailscale environment variables.
    (CVE-2022-41925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418051	SCA: security update for tailscale.com/cmd (GHSA-qccm-wmcq-pwr6)	Tenable Cloud Security	SCA Checks	high
418051	SCA: security update for tailscale.com/cmd (GHSA-qccm-wmcq-pwr6)	Tenable Self-Hosted Container Security	SCA Checks	high
407315	Alpine: multiple tailscale packages: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407315	Alpine: multiple tailscale packages: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
168042	FreeBSD : tailscale -- Security vulnerability in the client (e0f26ac5-6a17-11ed-93e7-901b0e9408dc)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2022-41925

high

Tenable Plugins

high

high

high

high

high