CVE-2023-50226
📋 TL;DR
This vulnerability allows local attackers with low-privileged access to escalate to root privileges by exploiting a symbolic link issue in Parallels Desktop's Updater service. Attackers can move arbitrary files to gain code execution as root. Only Parallels Desktop installations on macOS are affected.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise allowing complete system takeover, data theft, persistence installation, and lateral movement to other systems.
Likely Case
Local privilege escalation from a standard user account to root, enabling installation of malware, credential theft, and bypassing security controls.
If Mitigated
Limited impact if proper access controls prevent low-privileged code execution or if systems are isolated from untrusted users.
🎯 Exploit Status
Exploitation requires local access and ability to execute low-privileged code first. The vulnerability is straightforward to exploit once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.1.1 and later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Parallels Desktop menu > Check for Updates. 3. Install version 19.1.1 or later. 4. Restart the system to ensure the updated service loads.
🔧 Temporary Workarounds
Disable Parallels Desktop Updater Service
linuxTemporarily disable the vulnerable Updater service to prevent exploitation
sudo launchctl unload /Library/LaunchDaemons/com.parallels.desktop.launchdaemon.plist
Restrict Symbolic Link Creation
linuxLimit ability to create symbolic links in sensitive directories
sudo chmod 755 /private/tmp
sudo chmod 755 /tmp
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable Parallels Desktop versions
- Implement application whitelisting to prevent execution of unauthorized low-privileged code
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: Open Parallels Desktop > About Parallels Desktop. If version is below 19.1.1, system is vulnerable.Check Version:
defaults read /Applications/Parallels\ Desktop.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify version is 19.1.1 or higher in About Parallels Desktop dialog. Also check that the Updater service is running the patched version.📡 Detection & Monitoring
Log Indicators:
- Unusual symbolic link creation in /tmp or /private/tmp directories
- Parallels Updater service executing unexpected file operations
- Processes running with unexpected root privileges from user contexts
Network Indicators:
- No direct network indicators as this is a local exploit
SIEM Query:
source="macos" AND (event="file_create" AND path="/tmp/*" AND user!=root) OR (process="com.parallels.desktop.launchdaemon" AND action="file_move")