CVE-2023-47390
📋 TL;DR
Headscale versions through 0.22.3 write bearer tokens to info-level logs, exposing authentication credentials. This affects all Headscale deployments using the vulnerable versions. Attackers with access to logs could steal tokens and impersonate users or administrators.
💻 Affected Systems
- Headscale
📦 What is this software?
Headscale by Juanfont
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the Headscale control plane allowing attackers to join unauthorized devices to the network, intercept traffic, or gain administrative access to connected systems.
Likely Case
Unauthorized access to the Tailscale network, allowing attackers to join malicious devices and potentially access internal resources.
If Mitigated
Limited impact if logs are properly secured with restricted access and monitoring, though token exposure still creates risk.
🎯 Exploit Status
Exploitation requires access to logs containing the bearer tokens. No authentication bypass is needed once logs are accessed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.22.4 and later
Vendor Advisory: https://github.com/juanfont/headscale/issues/1259
Restart Required: Yes
Instructions:
1. Update Headscale to version 0.22.4 or later. 2. Restart the Headscale service. 3. Rotate all existing bearer tokens as previously logged tokens remain valid.
🔧 Temporary Workarounds
Restrict Log Access
linuxLimit access to Headscale log files to only authorized personnel and systems.
chmod 600 /var/log/headscale/*
setfacl -m u:headscale:r /var/log/headscale/*
Change Log Level
allTemporarily increase log level to reduce info-level logging, though this may affect debugging.
Edit Headscale config to set log_level: "warn" or higher
🧯 If You Can't Patch
- Rotate all bearer tokens immediately and monitor for unauthorized usage
- Implement strict access controls on log storage and transmission
🔍 How to Verify
Check if Vulnerable:
Check Headscale version: if version ≤ 0.22.3, system is vulnerableCheck Version:
headscale versionVerify Fix Applied:
Confirm Headscale version is ≥ 0.22.4 and check logs no longer contain bearer tokens📡 Detection & Monitoring
Log Indicators:
- Bearer tokens appearing in info-level logs
- Unauthorized authentication attempts with logged tokens
Network Indicators:
- Unexpected devices joining Tailscale network
- Unusual authentication patterns
SIEM Query:
source="headscale" AND "bearer" AND "token"