CVE-2023-27322
📋 TL;DR
This vulnerability in Parallels Desktop Service allows local attackers with low-privileged access to escalate to root privileges due to improper environment variable initialization. It affects Parallels Desktop installations on macOS systems where an attacker already has some foothold on the host.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level code execution, allowing installation of persistent malware, data theft, and full control of the macOS host.
Likely Case
Local privilege escalation from a standard user account to root, enabling attackers to bypass security controls, install additional tools, and access protected system resources.
If Mitigated
Limited impact if proper access controls prevent initial low-privileged code execution and service runs with minimal privileges.
🎯 Exploit Status
Exploitation requires existing local access but the vulnerability itself is straightforward to exploit once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.1.1 and later
Vendor Advisory: https://kb.parallels.com/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help > Check for Updates. 3. Install update 18.1.1 or later. 4. Restart the host system.
🔧 Temporary Workarounds
Disable Parallels Service
linuxTemporarily disable the Parallels Service to prevent exploitation while awaiting patch
sudo launchctl unload /Library/LaunchDaemons/com.parallels.vm.prl_*.plist
🧯 If You Can't Patch
- Restrict local user access to prevent initial low-privileged code execution
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version in About Parallels Desktop or run: /Applications/Parallels\ Desktop.app/Contents/MacOS/prlctl --versionCheck Version:
/Applications/Parallels\ Desktop.app/Contents/MacOS/prlctl --versionVerify Fix Applied:
Verify version is 18.1.1 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in system logs
- Parallels Service process spawning unexpected child processes with elevated privileges
Network Indicators:
- Not applicable - local privilege escalation
SIEM Query:
process where parent_process_name contains 'prl_' and process_name contains 'sudo' or process_user != parent_process_user