Tailscale Tailscale SSH’dagi imtiyozlarni oshirish zaifliklarini bartaraf etadigan mijoz yangilanishini tez orada chiqarishga tayyorlanmoqda. Xatoliklar tafsilotlari dam olish kunlari ommaga e’lon qilindi.
Tailscale WireGuard protokolidan foydalanib, tashkilot qurilmalari va xizmatlarini shaxsiy, tengdoshlararo tarmoq orqali ulaydigan mesh VPN xizmatini taqdim etadi.
Tailworm deb nomlangan Tailscale zaifliklari Cyberdione Labs hisobotida tasvirlangan. Unda Tailscale mijozining 1.104.2 versiyasi va tashkilotlar o‘zlari joylashtirishi mumkin bo‘lgan ochiq manbali boshqaruv serveri headscale’ning 0.29.5 versiyasiga ta’sir qiladigan 11 ta topilma ro‘yxatga olingan.
Cyberdione Labs hisobotni tuzatishlar mavjud bo‘lmasdan oldin e’lon qildi, bu ijtimoiy tarmoqlarda tanqidga uchradi, ammo tadqiqotchilar tezkor xabardorlik tuzatishni tezlashtirishini ta’kidladilar.
Topilmalarning oltitasi yuqori jiddiylik darajasida baholangan va ulardan to‘rttasi Tailscale SSH’ga tegishli — bu qurilma identifikatori va tarmoq siyosatiga asoslangan kirish huquqini parollar yoki kalitlar o‘rniga beradigan tizim.
Tailworm hisobotiga ko‘ra, Tailscale SSH ba’zi yo‘naltirish amallarini root imtiyozlari bilan bajaradi va ularni cheklashga mo‘ljallangan himoya choralarini aylanib o‘tish mumkin.
Bir qurilmani buzgan hujumchi bu zaiflikdan o‘sha qurilma Tailscale SSH orqali yetib borishi mumkin bo‘lgan har qanday serverga qarshi foydalanishi mumkin, agar kirish qoidasi yo‘naltirishga ruxsat bersa. Laboratoriya sinovlarida bu maqsadli serverlarda root kirish huquqiga va tarmoqqa soxta qurilmalar qo‘shish uchun ishlatilishi mumkin bo‘lgan kalitlarning o‘g‘irlanishiga olib keldi.
Bu dastlabki kirish odatiy usullar — masalan, fishing, zaif veb-ilova yoki zararli dasturiy paket orqali kelishi mumkin.
Tadqiqotchilar bu SSH zaifliklarining qurt (worm) xususiyatiga ega ekanligini ko‘rsatdilar. Foydalanuvchi ma’lumotlari ishtirok etmagani sababli, bu xatoliklarni zanjir qilib ishlaydigan avtomatlashtirilgan hujum har bir serverga siyosat SSH kirish huquqini bergan holda mashinadan mashinaga o‘tdi — har bir sakrashda bir soniyadan kam va foydalanuvchi aralashuvisiz.
Hisobot shuningdek, eksperimental ilova ulanish xususiyati, Serve xususiyati, headscale va mijozning relay komponentidagi zaifliklarni ham tasvirlaydi — ular bulut metama’lumotlari xizmatlari va ichki tarmoqlarga kirish qoidalarini aylanib o‘tib yetib borish, tugunning ma’muriy interfeysini masofaviy tengdoshlarga ochib qo‘yish yoki xizmatdan foydalanishni rad etish (DoS) sharoitlarini keltirib chiqarish uchun ishlatilishi mumkin.
Tailscale tuzatishlar yaqinligini aytmoqda
Reddit’da javob berib, Tailscale muhandislik bo‘yicha vitse-prezidenti Mayk Shaver kompaniya hisobot kelganida allaqachon o‘z tekshiruvini, tashqi xavfsizlik mutaxassislari ishtirokida, o‘tkazayotganini aytdi.
«Biz hozirgacha aniqlagan muammolarning aksariyati kimdir ulanishga ruxsat berilgandan keyin nima sodir bo‘lishiga, xususan Unix imtiyozlari va SSH yo‘naltirish qanday ishlatilishiga tegishli. Ba’zi hollarda sessiya sozlangan mahalliy foydalanuvchiga ruxsat etilganidan ko‘proq narsani qila olishi mumkin», — dedi Shaver.
«Bu jiddiy xavotir, ammo bu autentifikatsiyalanmagan hujumchining ixtiyoriy mashinalarga ulanishi bilan bir xil emas, ammo potentsial ta’sir SSH kirish qanday sozlanganiga bog‘liq», — deb qo‘shimcha qildi u.
Dushanba kuni e’lon qilingan yangilanishda Tailscale ko‘pchilik muammolar uchun tuzatishlar tayyor ekanligini va sinovdan o‘tganidan so‘ng, 27-oktabr, seshanba kuni oxirigacha tuzatilgan mijozni chiqarishni maqsad qilganini aytdi. Yangilanish chiqqanidan so‘ng xavfsizlik maslahati va texnik yozuv e’lon qilinadi.
Seshanba kuni yangilangan Tailworm hisobotida bir nechta topilma uchun tuzatishlar Tailscale’ning ochiq kod omborlariga kiritilgani aytiladi. O‘sha paytda ularning hech biri raqamlangan relizga kirmagan edi.
«Hozirgi baholashimizga ko‘ra, biz hammaga Tailscale SSH’ni o‘chirib qo‘yishni tavsiya qilmayapmiz», — dedi sotuvchi.
Tuzatish kelguncha, Tailscale tashkilotlarga SSH kirish siyosatlarini ko‘rib chiqishni va kerak bo‘lmagan joylarda SSH yo‘naltirishni o‘chirib qo‘yishni tavsiya qiladi — bu jiddiyroq topilmalarning bir nechtasini yumshatadi, deydi u.
Na Tailscale, na Tailworm hisobotida amalda foydalanish (in-the-wild exploitation) haqida eslatib o‘tilmagan.
Bog‘liq: HPE Tarmoq Mahsulotlaridagi O‘nlab Jiddiy Zaifliklarni Tuzatdi
Bog‘liq: O‘lik Popcorn Time Yangilovchisi Millionlab Kompyuterlarni Boshqaruvga Olish Xavfiga Qo‘ydi
Bog‘liq: PHP2Shell Foydalanishi Tekshiruvlardan Ishlaydigan Shellarga O‘tdi
Bog‘liq: Node2Shell: Brotli Zaifligi Microsoft, Node.js, Python Paketlarida Tuzatishlarni Tezlashtirdi
Tailscale is getting ready to ship a client update that addresses privilege escalation weaknesses in Tailscale SSH. Details of the bugs went public over the weekend.
Tailscale provides a mesh VPN service that uses the WireGuard protocol to connect an organization’s devices and services over a private, peer-to-peer network.
The Tailscale vulnerabilities, dubbed Tailworm, are described in a report from Cyberdione Labs. It lists 11 findings affecting version 1.104.2 of the Tailscale client and version 0.29.5 of headscale, an open source control server that organizations can host themselves.
Cyberdione Labs published the report before any patches were available, drawing criticism on social media, though the researchers argued that rapid awareness would speed up remediation.
Six of the findings are rated high severity, and four of them concern Tailscale SSH, which grants access based on device identity and network policy instead of passwords or keys.
According to the Tailworm report, Tailscale SSH performs some forwarding operations with root privileges, and the safeguards meant to restrict them can be bypassed.
An attacker who has compromised one device could exploit this against any server that device is permitted to reach over Tailscale SSH, as long as the access rule allows forwarding. In lab tests, this resulted in root access on target servers and the theft of keys that can be used to add rogue devices to the network.
That initial foothold could come from common methods such as phishing, a vulnerable web application or a malicious software package.
Researchers showed that these SSH flaws are wormable. Since no user credentials are involved, an automated attack chaining these bugs moved from machine to machine across every server the policy granted SSH access to, at under a second per hop and with no user interaction.
The report also describes flaws in an experimental app connector feature, the Serve feature, headscale and the client’s relay component that could be exploited to reach cloud metadata services and internal networks while bypassing access rules, expose a node’s administrative interface to remote peers, or cause denial-of-service (DoS) conditions.
Tailscale says fixes are close
Responding on Reddit, Tailscale VP of Engineering Mike Shaver said the company was already running its own investigation, with input from outside security specialists, when the report came in.
“Most of the issues we’ve identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do,” Shaver said.
“While it’s a serious concern, it isn’t the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured,” he added.
In an update shared on Monday, Tailscale said fixes were in place for most of the issues and that it was aiming to release a patched client by the end of Tuesday, October 27, pending testing. A security advisory and a technical write-up will follow once the update is out.
The Tailworm report, updated on Tuesday, says fixes for several findings have landed in Tailscale’s public code repositories. None had made it into a numbered release at that point.
“Based on our current assessment, we’re not recommending that everyone disable Tailscale SSH,” the vendor said.
Until the patch arrives, Tailscale advises organizations to review their SSH access policies and disable SSH forwarding where it isn’t needed, which it says mitigates several of the more serious findings.
Neither Tailscale nor the Tailworm report mentions in-the-wild exploitation.
Related: HPE Patches Dozens of Critical Flaws in Networking Products
Related: Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Related: PHP2Shell Exploitation Moves From Probes to Working Shells
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages