{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2022-004",
  "link": "https://tailscale.com/security-bulletins/#ts-2022-004",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2022-004",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Mon, 21 Nov 2022 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eReference\u003c/em\u003e\u003c/strong\u003e: \u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2022-41924\"\u003eCVE-2022-41924\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSeverity\u003c/em\u003e\u003c/strong\u003e: Critical\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCVSS vector string\u003c/em\u003e\u003c/strong\u003e: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:H\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon \u003ccode\u003etailscaled\u003c/code\u003e, which can then be used to remotely execute code.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAffected platforms\u003c/em\u003e\u003c/strong\u003e: Windows\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePatched Tailscale client versions\u003c/em\u003e\u003c/strong\u003e: v1.32.3 or later, v1.33.257 or later (unstable)\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eIn the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003eAll Windows clients prior to version v1.32.3 are affected.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node.\u003c/p\u003e\n\u003cp\u003eReviewing all logs confirms this vulnerability was not triggered or exploited.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eIf you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.\u003c/strong\u003e\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank \u003ca href=\"https://github.com/emilytrau\"\u003eEmily Trau\u003c/a\u003e and \u003ca href=\"https://twitter.com/JJJollyjim\"\u003eJamie McClymont (CyberCX)\u003c/a\u003e for reporting this issue. Further detail is available in \u003ca href=\"https://emily.id.au/tailscale\"\u003etheir blog post\u003c/a\u003e.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eReference\u003c/em\u003e\u003c/strong\u003e: \u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2022-41924\"\u003eCVE-2022-41924\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSeverity\u003c/em\u003e\u003c/strong\u003e: Critical\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCVSS vector string\u003c/em\u003e\u003c/strong\u003e: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:H\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon \u003ccode\u003etailscaled\u003c/code\u003e, which can then be used to remotely execute code.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAffected platforms\u003c/em\u003e\u003c/strong\u003e: Windows\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePatched Tailscale client versions\u003c/em\u003e\u003c/strong\u003e: v1.32.3 or later, v1.33.257 or later (unstable)\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eIn the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003eAll Windows clients prior to version v1.32.3 are affected.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node.\u003c/p\u003e\n\u003cp\u003eReviewing all logs confirms this vulnerability was not triggered or exploited.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eIf you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.\u003c/strong\u003e\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank \u003ca href=\"https://github.com/emilytrau\"\u003eEmily Trau\u003c/a\u003e and \u003ca href=\"https://twitter.com/JJJollyjim\"\u003eJamie McClymont (CyberCX)\u003c/a\u003e for reporting this issue. Further detail is available in \u003ca href=\"https://emily.id.au/tailscale\"\u003etheir blog post\u003c/a\u003e.\u003c/p\u003e"
  },
  "title": "TS-2022-004",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2022-004"
  }
}