{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2022-005",
  "link": "https://tailscale.com/security-bulletins/#ts-2022-005",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2022-005",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Mon, 21 Nov 2022 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eReference\u003c/em\u003e\u003c/strong\u003e: \u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2022-41925\"\u003eCVE-2022-41925\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSeverity\u003c/em\u003e\u003c/strong\u003e: Low\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCVSS vector string\u003c/em\u003e\u003c/strong\u003e: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAffected platforms\u003c/em\u003e\u003c/strong\u003e: All\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePatched Tailscale client versions\u003c/em\u003e\u003c/strong\u003e: v1.32.3 or later, v1.33.257 or later (unstable)\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eIn the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node\u2019s Tailscale environment variables.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003eAll Tailscale clients prior to version v1.32.3 are affected.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker with access to the peer API on a node could use that access to read the node\u2019s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user\u2019s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop.\u003c/p\u003e\n\u003cp\u003eAn attacker with access to the peer API who sent a malicious file via Taildrop which was accessed while it was loading could use this to gain access to the local API, and remotely execute code.\u003c/p\u003e\n\u003cp\u003eThere is no evidence of this vulnerability being purposefully triggered or exploited.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eUpgrade to v1.32.3 or later to remediate the issue.\u003c/strong\u003e\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank \u003ca href=\"https://github.com/emilytrau\"\u003eEmily Trau\u003c/a\u003e and \u003ca href=\"https://twitter.com/JJJollyjim\"\u003eJamie McClymont (CyberCX)\u003c/a\u003e for reporting this issue. Further detail is available in \u003ca href=\"https://emily.id.au/tailscale\"\u003etheir blog post\u003c/a\u003e.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eReference\u003c/em\u003e\u003c/strong\u003e: \u003ca href=\"https://www.cve.org/CVERecord?id=CVE-2022-41925\"\u003eCVE-2022-41925\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eSeverity\u003c/em\u003e\u003c/strong\u003e: Low\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eCVSS vector string\u003c/em\u003e\u003c/strong\u003e: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003eAffected platforms\u003c/em\u003e\u003c/strong\u003e: All\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e\u003cem\u003ePatched Tailscale client versions\u003c/em\u003e\u003c/strong\u003e: v1.32.3 or later, v1.33.257 or later (unstable)\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eIn the Tailscale client, the peer API was vulnerable to DNS rebinding. This allowed an attacker-controlled website visited by the node to rebind DNS for the peer API to an attacker-controlled DNS server, and then making peer API requests in the client, including accessing the node\u2019s Tailscale environment variables.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003eAll Tailscale clients prior to version v1.32.3 are affected.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003eAn attacker with access to the peer API on a node could use that access to read the node\u2019s environment variables, including any credentials or secrets stored in environment variables. This may include Tailscale authentication keys, which could then be used to add new nodes to the user\u2019s tailnet. The peer API access could also be used to learn of other nodes in the tailnet or send files via Taildrop.\u003c/p\u003e\n\u003cp\u003eAn attacker with access to the peer API who sent a malicious file via Taildrop which was accessed while it was loading could use this to gain access to the local API, and remotely execute code.\u003c/p\u003e\n\u003cp\u003eThere is no evidence of this vulnerability being purposefully triggered or exploited.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eUpgrade to v1.32.3 or later to remediate the issue.\u003c/strong\u003e\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank \u003ca href=\"https://github.com/emilytrau\"\u003eEmily Trau\u003c/a\u003e and \u003ca href=\"https://twitter.com/JJJollyjim\"\u003eJamie McClymont (CyberCX)\u003c/a\u003e for reporting this issue. Further detail is available in \u003ca href=\"https://emily.id.au/tailscale\"\u003etheir blog post\u003c/a\u003e.\u003c/p\u003e"
  },
  "title": "TS-2022-005",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2022-005"
  }
}