# CVE-2022-41924 - RCE in Tailscale, DNS Rebinding, and You

DNS rebinding against Tailscale's Windows LocalAPI and PeerAPI let malicious JS reconfigure tailscaled, pivot to attacker control plane, and achieve RCE via PopBrowserURL and Taildrop.

- Payout: $10,000
- Severity: critical
- Program: Tailscale
- Credited: Jamie McClymont, Emily Trau
- Disclosed: 2022-11-22
- CVE: CVE-2022-41924, CVE-2022-41925
- Write-up quality: 9/10
- Original: https://emily.id.au/tailscale
- Library page: https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale
- Tags: domain:desktop impact:internal-access impact:rce kind:bounty platform:blog sev:critical tech:windows technique:chained technique:race-window technique:source-review vuln:misconfiguration vuln:rce vuln:xss

**Target:** Tailscale tailscaled LocalAPI/PeerAPI/Quad100 HTTP endpoints
**Root cause:** LocalAPI on Windows binds loopback TCP 127.0.0.1:41112 and PeerAPI/Quad100 HTTP servers lack Host header allowlists, so DNS rebinding lets attacker JS reach them same-origin; control plane-supplied PopBrowserURL is opened as an arbitrary file path.
**Steps:**
1. Host page on rebind.it domain resolving first to attacker IP, then to 127.0.0.1
2. JS fetches `PATCH /localapi/v0/prefs {}` to leak `PrivateNodeKey`, or PATCH `ControlURL` to attacker Headscale
3. Rebind to Quad100 `100.100.100.100` to learn tailnet IP, then to PeerAPI port to Taildrop `malware.exe`
4. Trigger `PopBrowserURL: \\100.64.0.1` SMB to leak NTLM hash/username, then `PopBrowserURL: C:\Users\<user>\Desktop\malware.exe`
5. For Chrome: upload duplicate-named HTML via PeerAPI to win race, load `http://127.0.0.1:41112/localapi/v0/files/evil.html` iframe for XSS, then use Fast User Switching profiles API to switch ControlURL without reboot
**How found:** Noticed Windows LocalAPI uses loopback TCP instead of unix socket, hypothesized DNS rebinding bypasses SOP; then explored control-plane-controlled PopBrowserURL and Taildrop file handling for code execution paths.
**Exploitation:** Attacker page rebinds to loopback LocalAPI, reconfigures ControlURL to malicious Headscale, registers victim node, Taildrops untainted executable to desktop, and uses PopBrowserURL to launch it; SMB path leaks username first.
**Escalation:** Chained issues 1-6: rebinding → control plane takeover → Taildrop MOTW bypass → arbitrary path open → RCE; XSS via LocalAPI Content-Type text/html bypasses Chrome PNA.
**Insight:** When a local daemon uses loopback TCP instead of unix sockets, check for Host header validation; also audit any server-controlled URL/path fields forwarded to OS open handlers and file-drop features for MOTW/quarantine bypass.