CVE-2023-27328
📋 TL;DR
This vulnerability allows local attackers on Parallels Desktop guest systems to escalate privileges by exploiting XML injection in the Toolgate component. Attackers must first execute low-privileged code on the guest system, then can leverage the flaw to execute arbitrary code with hypervisor privileges. Affects Parallels Desktop installations with vulnerable Toolgate components.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the hypervisor host system, allowing attacker to escape guest VM isolation and gain full control over the host operating system and all other VMs.
Likely Case
Privilege escalation from guest user to hypervisor-level access, enabling installation of persistent malware, data theft from other VMs, and lateral movement within the virtual environment.
If Mitigated
Limited to guest VM compromise only, with hypervisor isolation preventing host system access if proper security controls are implemented.
🎯 Exploit Status
Requires local code execution on guest VM first. XML injection technique is well-understood but specific Toolgate implementation details may require research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.1.1 or later
Vendor Advisory: https://kb.parallels.com/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help → Check for Updates. 3. Install update to version 18.1.1 or newer. 4. Restart all running VMs and the Parallels Desktop application.
🔧 Temporary Workarounds
Disable Toolgate component
allRemove or disable the vulnerable Toolgate feature that handles XML processing
Not available - requires configuration changes in Parallels Desktop settings
Restrict guest VM privileges
allConfigure guest VMs with minimal privileges and disable unnecessary Parallels Tools components
🧯 If You Can't Patch
- Isolate Parallels Desktop host from critical networks and systems
- Implement strict access controls on guest VMs and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: In macOS, open Parallels Desktop → About Parallels Desktop. If version is below 18.1.1, system is vulnerable.Check Version:
On macOS host: /usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' '/Applications/Parallels Desktop.app/Contents/Info.plist'Verify Fix Applied:
Confirm version is 18.1.1 or newer in About Parallels Desktop dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual Toolgate component activity
- XML parsing errors in Parallels logs
- Privilege escalation attempts from guest VMs
Network Indicators:
- Unexpected hypervisor-level network activity from guest VM contexts
SIEM Query:
source="parallels*" AND (event_type="privilege_escalation" OR message="*toolgate*" OR message="*xml*" AND severity=HIGH)