CVE-2020-8968
📋 TL;DR
CVE-2020-8968 allows a local attacker to retrieve Parallels RAS profile passwords in clear text by uploading a previously stored encrypted file. This compromises user confidentiality, availability, and integrity. Organizations using Parallels Remote Application Server are affected.
💻 Affected Systems
- Parallels Remote Application Server (RAS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to Parallels RAS, compromising all managed systems and user credentials, leading to full system takeover.
Likely Case
Local attackers extract credentials to escalate privileges, access sensitive data, or move laterally within the network.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated credential exposure without broader system compromise.
🎯 Exploit Status
Exploitation involves uploading a specific encrypted file to retrieve clear-text passwords; no public exploit code is referenced.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Parallels vendor advisory for specific patched versions
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors
Restart Required: Yes
Instructions:
1. Review the vendor advisory for patched versions. 2. Update Parallels RAS to the latest secure version. 3. Restart the Parallels RAS services or server as required.
🔧 Temporary Workarounds
Restrict Local Access
allLimit physical and remote local access to Parallels RAS servers to trusted administrators only.
Monitor File Uploads
windowsImplement monitoring for unauthorized file uploads to Parallels RAS directories.
🧯 If You Can't Patch
- Implement strict access controls to prevent local unauthorized users from accessing the Parallels RAS server.
- Regularly audit and rotate stored credentials to limit exposure if compromised.
🔍 How to Verify
Check if Vulnerable:
Check the Parallels RAS version against the vendor advisory; if unpatched and local access is possible, assume vulnerable.Check Version:
Check within Parallels RAS admin console or refer to installation documentation for version command.Verify Fix Applied:
Confirm the Parallels RAS version is updated to a patched release as specified in the vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activities to Parallels RAS directories
- Failed or successful local login attempts by unauthorized users
Network Indicators:
- Local network traffic to Parallels RAS server from unexpected sources
SIEM Query:
Example: search for event logs indicating file modifications in Parallels RAS paths or unauthorized local access.