CVE-2022-34901
📋 TL;DR
This vulnerability allows local attackers with low-privileged code execution on affected Parallels Access Agent installations to escalate privileges to root by exploiting the Parallels Service's execution of files from an unsecured location. It affects Parallels Access 6.5.4 (39316) Agent installations. Attackers must already have local access to the system to exploit this flaw.
💻 Affected Systems
- Parallels Access Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level arbitrary code execution, allowing complete control over the host system, data theft, persistence establishment, and lateral movement.
Likely Case
Local privilege escalation from a low-privileged user account to root, enabling installation of malware, data access, and system configuration changes.
If Mitigated
Limited impact if proper access controls prevent local low-privileged code execution and service hardening is implemented.
🎯 Exploit Status
Exploitation requires local access and ability to execute low-privileged code; the vulnerability mechanism is straightforward once initial access is achieved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parallels Access 6.5.4 (39317) or later
Vendor Advisory: https://kb.parallels.com/en/129010
Restart Required: Yes
Instructions:
1. Update Parallels Access to version 6.5.4 (39317) or later. 2. Restart the Parallels Service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Parallels Service permissions
allLimit the Parallels Service to execute only from secure, controlled directories
# Review and modify service permissions based on your OS
# Example for Linux: chmod 750 /path/to/parallels/service
# Example for Windows: icacls "C:\Program Files\Parallels\" /deny Users:(OI)(CI)W
Implement strict access controls
allPrevent unauthorized local users from executing code on systems with Parallels Access Agent
# Implement least privilege principles
# Use application whitelisting
# Restrict user permissions
🧯 If You Can't Patch
- Remove Parallels Access Agent if not essential
- Implement strict network segmentation and isolate affected systems
🔍 How to Verify
Check if Vulnerable:
Check Parallels Access Agent version: On Windows - Check Programs and Features; On macOS/Linux - Check installed version via package manager or Parallels interface.Check Version:
# Windows: wmic product where name="Parallels Access" get version
# macOS/Linux: Check Parallels Access interface or installed packagesVerify Fix Applied:
Verify version is 6.5.4 (39317) or later and that the Parallels Service is running with updated binaries.📡 Detection & Monitoring
Log Indicators:
- Unauthorized file writes to Parallels service directories
- Unexpected privilege escalation events
- Parallels Service executing files from unusual locations
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
Event logs showing privilege escalation from low-privileged accounts to SYSTEM/root on systems with Parallels Access