CVE-2022-41924: Tailscale Windows Client RCE Vulnerability

CVE-2022-41924 Overview

A critical vulnerability in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon tailscaled, which can then be used to remotely execute code. The local API was bound to a local TCP socket and communicated with the Windows client GUI in cleartext with no Host header verification. This design flaw allows an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server.

Critical Impact

An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share, enabling remote code execution on affected Windows nodes.

Affected Products

• Tailscale Windows client versions prior to v1.32.3
• Microsoft Windows operating systems running vulnerable Tailscale versions
• All Windows clients with the Tailscale daemon (tailscaled) exposed via local TCP socket

Discovery Timeline

• November 23, 2022 - CVE-2022-41924 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-41924

Vulnerability Analysis

This vulnerability exploits a fundamental design weakness in the Tailscale Windows client's local API communication mechanism. The vulnerability is classified under CWE-346 (Origin Validation Error), indicating that the application fails to properly validate the origin of incoming requests.

The Tailscale Windows client architecture binds its local API to a TCP socket for communication with the Windows GUI component. However, this communication occurs in cleartext without implementing Host header verification—a critical security control that would normally prevent unauthorized requests from external sources.

The absence of Host header validation creates an exploitable condition where DNS rebinding attacks become feasible. DNS rebinding is a technique that allows an attacker to bypass same-origin policy protections by manipulating DNS resolution to point a domain to an internal IP address (in this case, localhost) after initial security checks have passed.

Root Cause

The root cause of this vulnerability is the lack of Host header verification in the local API communication between the Tailscale daemon and the Windows client GUI. By binding to a local TCP socket without proper origin validation, the daemon accepts requests from any source that can reach the socket, including malicious web content executing in the user's browser.

Attack Vector

The attack leverages DNS rebinding, a sophisticated technique that exploits the time gap between DNS resolution and subsequent HTTP requests. The attack chain proceeds as follows:

1. Initial Compromise: The victim visits an attacker-controlled website while running the Tailscale Windows client
2. DNS Rebinding: The malicious website triggers a DNS rebind, redirecting its domain to resolve to 127.0.0.1 (localhost)
3. Local API Access: Once the DNS rebind completes, the attacker's JavaScript can make requests to the local Tailscale API as if it were communicating with its own origin
4. Configuration Manipulation: The attacker modifies the coordination server setting to point to an attacker-controlled server
5. Payload Delivery: The malicious coordination server responds with crafted URL responses that can push executables or mount SMB shares
6. Code Execution: The delivered payloads execute on the victim's system, achieving remote code execution

The attack requires user interaction (visiting a malicious website) but requires no privileges on the target system, and the scope extends beyond the vulnerable component itself.

Detection Methods for CVE-2022-41924

Indicators of Compromise

• Unexpected changes to Tailscale coordination server configuration pointing to unknown or suspicious domains
• DNS queries resolving legitimate domains to 127.0.0.1 or localhost addresses
• Unusual network connections from the tailscaled process to external coordination servers
• SMB share mounts or executable downloads initiated through Tailscale client processes

Detection Strategies

• Monitor for DNS rebinding patterns where external domains resolve to internal/localhost IP addresses
• Implement network detection rules for unusual local API traffic patterns on Tailscale client ports
• Alert on changes to Tailscale coordination server settings that deviate from organizational baselines
• Track process execution chains originating from the Tailscale Windows client for suspicious child processes

Monitoring Recommendations

• Enable verbose logging on Tailscale Windows clients to capture API request origins and configuration changes
• Deploy endpoint detection and response (EDR) solutions to monitor for DNS rebinding attack indicators
• Implement network segmentation monitoring to detect unusual traffic flows from Tailscale client processes
• Configure SIEM alerts for coordination server configuration modifications across the fleet

How to Mitigate CVE-2022-41924

Immediate Actions Required

• Upgrade all Tailscale Windows clients to version v1.32.3 or later immediately
• Audit current Tailscale coordination server configurations to ensure they point to legitimate endpoints
• Review endpoint logs for any indicators of exploitation or configuration tampering
• Consider temporarily disabling Tailscale on critical Windows systems until patching is complete

Patch Information

Tailscale has released version v1.32.3 which addresses this vulnerability by implementing proper Host header verification in the local API communication. Organizations should prioritize upgrading all affected Windows clients to this version or later. For detailed patch information, refer to the Tailscale Security Bulletin TS-2022-004 and the GitHub Security Advisory GHSA-vqp6-rc3h-83cp.

Workarounds

• Restrict browser access on systems running vulnerable Tailscale versions to minimize exposure to malicious websites
• Implement network-level DNS filtering to detect and block DNS rebinding attempts
• Use browser extensions or proxy configurations that prevent DNS rebinding attacks
• Isolate systems running Tailscale Windows clients from general internet browsing activities until patched

# Verify Tailscale version on Windows (PowerShell)
tailscale version
# Expected output should show v1.32.3 or higher

# Check current coordination server configuration
tailscale status --json | Select-String "ControlURL"