{"id":2174,"date":"2025-02-24T10:06:35","date_gmt":"2025-02-24T10:06:35","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/24\/parallels-desktop-0-day-vulnerability-gain-root-privileges-poc-released\/"},"modified":"2025-02-24T10:06:35","modified_gmt":"2025-02-24T10:06:35","slug":"parallels-desktop-0-day-vulnerability-gain-root-privileges-poc-released","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/24\/parallels-desktop-0-day-vulnerability-gain-root-privileges-poc-released\/","title":{"rendered":"Parallels Desktop 0-Day Vulnerability Gain Root Privileges \u2013 PoC Released"},"content":{"rendered":"

Parallels Desktop 0-Day Vulnerability Gain Root Privileges \u2013 PoC Released
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical 0-day vulnerability<\/a> in Parallels Desktop virtualization software has been publicly disclosed, enabling local attackers to escalate privileges to root-level access on macOS systems.\u00a0<\/p>\n

All versions of Parallels Desktop, including the most recent 20.2.1 (55876), are vulnerable to the flaw identified as CVE-2024-34331, which results from insufficient security controls in the application\u2019s macOS installer repackaging subsystem.<\/p>\n

Security researcher Mickey Jin (@patch1t) released proof-of-concept (PoC) exploits demonstrating two distinct bypass methods for CVE-2024-34331, a previously patched privilege escalation flaw.\u00a0<\/p>\n

Parallels Desktop 0-Day Vulnerability<\/strong><\/h2>\n

The vulnerability resides in Parallels Desktop\u2019s repack_osx_install_app.sh script, which handles macOS<\/a> installer repackaging operations with root privileges via the prl_disp_service daemon.\u00a0<\/p>\n

The original CVE-2024-34331 patch introduced Apple code signature verification for the createinstallmedia binary using the codesign -v -R=\u201danchor apple\u201d command.\u00a0<\/p>\n

However, researchers identified two critical bypass mechanisms:<\/p>\n

Time-of-Check to Time-of-Use (TOCTOU) Exploitation:<\/strong><\/h2>\n

Attackers can replace the legitimate createinstallmedia binary with a malicious payload<\/a> during the narrow window between signature verification and execution.\u00a0<\/p>\n

Jin\u2019s first PoC (exploit1.sh) demonstrates this by creating a fake macOS installer bundle with \/bin\/ls masquerading as createinstallmedia, and triggering Parallels\u2019 repackaging workflow.<\/p>\n

Further, swapping the binary with a payload script during temporary directory creation,<\/p>\n

The payload executes with root privileges via the SUID-enabled prl_disp_service, enabling commands like touch \/Library\/lpe to create persistence mechanisms.<\/p>\n

Weak Signature Enforcement via DYLIB Injection<\/strong><\/h2>\n

The \u201canchor apple\u201d requirement allows any Apple-signed binary (e.g., \/bin\/ls) to pass verification.\u00a0<\/p>\n

Attackers can inject malicious dynamic libraries (DYLIBs) into these binaries using environment variable manipulation or DYLD_INSERT_LIBRARIES techniques.\u00a0<\/p>\n

This bypass leverages macOS\u2019s code<\/a> signing design to subvert Parallels\u2019 security checks while maintaining legitimate Apple signatures.<\/p>\n

Evolution of Exploit Techniques<\/strong><\/h2>\n

Parallels attempted to mitigate these issues in version 19.4.1 by switching to a do_repack_manual function that uses 7z compression for installer creation.\u00a0<\/p>\n

However, Jin identified a path traversal vulnerability in the function\u2019s handling of the CFBundleDisplayName parameter.\u00a0<\/p>\n

By setting this value to ..\/..\/..\/..\/..\/..\/tmp\/lnk\/result, attackers could:<\/p>\n

    \n
  • Create symbolic links redirecting root-owned directories<\/li>\n
  • Replace the 7z binary with a malicious payload during temporary file operations<\/li>\n
  • Trigger execution via Parallels\u2019 privileged services.<\/li>\n<\/ul>\n

    The vendor later reverted to the vulnerable do_repack_createinstallmedia method in version 20.2.1, reactivating the original exploit vectors.\u00a0<\/p>\n

    A video demonstration shows successful privilege escalation on updated systems.<\/p>\n

    \n
    \n