Hacker News Reader

Comment by amluto | Hacker News Reader

I don't see a writeup of how this was fixed. Merely checking the Host header is insufficient -- the vulnerability would still be wide open to anyone who can open TCP sockets to localhost.

Windows has APIs (named pipes, DCOM (eww) and such) that allow authenticated local access to services. Unixes have unix sockets.

View on HN

(This comment was in response to the original submission https://tailscale.com/security-bulletins/#ts-2022-004, which we've since changed)

Windows from W10 onwards has Unix sockets too.

The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.

Yes, but their existing TCP implementation wouldn't have been doing any auth either. So presumably they don't need it.

(I don't know anything about Tailscale so I'm just going on first principles.)

Didn't the article say they use netstat to do some checks?

Ah yes, the new link says that. The old link didn't that detail.

[co-author of the research here]

They actually approximate this functionality in the Windows implementation: It checks netstat to enforce that incoming TCP connections are from the expected Windows user! https://github.com/tailscale/tailscale/blob/2a991a3541ae5d56...

That's why we were happy with the solution they implemented as a stopgap, until they could switch to named pipes (which there is now an open PR for).

Huh, ok, that's not so bad then.

It feels like there could still be a TOCTOU issue there, but it'd be difficult to use.

Generally speaking, allowing privileged operations because a specific user asked over a TCP socket is asking for trouble: there are quite a few ways that unwitting processes could open a socket on behalf of an attacker without realizing that it is asserting its identity and thus granting privilege.

All the major cloud get this IMO entirely wrong with their services that issue secrets to instances (e.g. AWS IDMS).

With tcp being connection-oriented I think it's not too hard to get right, especially if the OS won't reuse a closed socket right away. Definitely worth considering though. Of course it's doable without netstat if you can track down the right apis https://stackoverflow.com/questions/47659365/find-process-ow...

Could still use plain old filesystem permissions no ?

Looks like it might be this? https://github.com/tailscale/tailscale/commit/976e88d430e0c5...

There were a number of changes: https://github.com/tailscale/tailscale/commits/v1.32.3

Reply on news.ycombinator.com