{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2023-001",
  "link": "https://tailscale.com/security-bulletins/#ts-2023-001",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2023-001",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Tue, 17 Jan 2023 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: An issue in the Tailscale coordination server allowed a malicious individual to share nodes from other tailnets to themselves, if they knew the node ID of the target.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eA bug in Tailscale\u2019s node sharing logic allowed the creation of sharing invitations by unauthorized users. A malicious individual who knew a target node\u2019s database ID could generate and accept a sharing invite for that node without being an admin of the target node\u2019s tailnet.\u003c/p\u003e\n\u003cp\u003eThis was possible for any node in any tailnet, as long as the individual knew the target\u2019s node ID. The node ID is an integer used in the admin panel\u2019s database, and is not related to the node \u201cStableID\u201d that is visible to Tailscale clients. A node\u2019s ID is only visible in the API or admin console, by admins of either the node\u2019s tailnet or a tailnet to which that node has already been shared. IDs are random 64-bit numbers that are not sequential or otherwise easily guessable.\u003c/p\u003e\n\u003cp\u003eThe bug was introduced on 2022-09-14, reported to us on 2023-01-11, and remediated on 2023-01-12.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003eAll tailnets with nodes are affected.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eThis vulnerability was not triggered or exploited\u003c/strong\u003e. Analysis of tailnet logs shows that no unauthorized shares were created or accepted while the vulnerability was present, except as part of the proof of concept from the individual who reported the vulnerability.\u003c/p\u003e\n\u003cp\u003eAdmins of a tailnet can review \u003ca href=\"https://login.tailscale.com/admin/machines?q=shared%3Aout\"\u003enodes that are shared out of their tailnet\u003c/a\u003e in the admin console. Sharing invites are logged as \u003ca href=\"https://tailscale.com/kb/1203/audit-logging/#events-for-shared-nodes\"\u003eevents in configuration audit logs\u003c/a\u003e. Admins can also review \u003ca href=\"https://login.tailscale.com/admin/logs?events=%5B%22INVITECREATENODE_SHARE%22%2C%22INVITEACCEPTNODE_SHARE%22%5D\"\u003einvites created and accepted in their configuration audit logs\u003c/a\u003e in the admin console.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eNo action is required\u003c/strong\u003e. Tailscale has deployed a fix to the coordination server as of 2023-01-12, and verified that the vulnerability was not exploited.\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank Benjamin Roberts (\u003ca href=\"https://github.com/tsujamin\"\u003etsujamin\u003c/a\u003e) for reporting this issue.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: An issue in the Tailscale coordination server allowed a malicious individual to share nodes from other tailnets to themselves, if they knew the node ID of the target.\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eA bug in Tailscale\u2019s node sharing logic allowed the creation of sharing invitations by unauthorized users. A malicious individual who knew a target node\u2019s database ID could generate and accept a sharing invite for that node without being an admin of the target node\u2019s tailnet.\u003c/p\u003e\n\u003cp\u003eThis was possible for any node in any tailnet, as long as the individual knew the target\u2019s node ID. The node ID is an integer used in the admin panel\u2019s database, and is not related to the node \u201cStableID\u201d that is visible to Tailscale clients. A node\u2019s ID is only visible in the API or admin console, by admins of either the node\u2019s tailnet or a tailnet to which that node has already been shared. IDs are random 64-bit numbers that are not sequential or otherwise easily guessable.\u003c/p\u003e\n\u003cp\u003eThe bug was introduced on 2022-09-14, reported to us on 2023-01-11, and remediated on 2023-01-12.\u003c/p\u003e\n\u003ch4\u003eWho is affected?\u003c/h4\u003e\n\u003cp\u003eAll tailnets with nodes are affected.\u003c/p\u003e\n\u003ch4\u003eWhat is the impact?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eThis vulnerability was not triggered or exploited\u003c/strong\u003e. Analysis of tailnet logs shows that no unauthorized shares were created or accepted while the vulnerability was present, except as part of the proof of concept from the individual who reported the vulnerability.\u003c/p\u003e\n\u003cp\u003eAdmins of a tailnet can review \u003ca href=\"https://login.tailscale.com/admin/machines?q=shared%3Aout\"\u003enodes that are shared out of their tailnet\u003c/a\u003e in the admin console. Sharing invites are logged as \u003ca href=\"https://tailscale.com/kb/1203/audit-logging/#events-for-shared-nodes\"\u003eevents in configuration audit logs\u003c/a\u003e. Admins can also review \u003ca href=\"https://login.tailscale.com/admin/logs?events=%5B%22INVITECREATENODE_SHARE%22%2C%22INVITEACCEPTNODE_SHARE%22%5D\"\u003einvites created and accepted in their configuration audit logs\u003c/a\u003e in the admin console.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003e\u003cstrong\u003eNo action is required\u003c/strong\u003e. Tailscale has deployed a fix to the coordination server as of 2023-01-12, and verified that the vulnerability was not exploited.\u003c/p\u003e\n\u003ch4\u003eCredits\u003c/h4\u003e\n\u003cp\u003eWe would like to thank Benjamin Roberts (\u003ca href=\"https://github.com/tsujamin\"\u003etsujamin\u003c/a\u003e) for reporting this issue.\u003c/p\u003e"
  },
  "title": "TS-2023-001",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2023-001"
  }
}