Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability

Successful exploitation of CVE-2023-27326 allows a local attacker to escalate privileges on the affected macOS system. This means an attacker who already has some level of access to the system can leverage this vulnerability to gain root or administrator-level privileges. The attacker could then execute arbitrary code, modify system files, install malware, or compromise the confidentiality and integrity of the entire system. The vulnerability requires the attacker to first have the ability to execute high-privileged code on the target guest system, limiting the immediate attack surface but still posing a significant risk in compromised environments.

Users of Parallels Desktop running version 18.0.2 (53077) on macOS are at direct risk. This includes individuals and organizations utilizing Parallels Desktop for running virtual machines, particularly those with less stringent security practices or those who routinely grant high privileges to guest operating systems.

• macos: Use ls -l to check file permissions and ownership in directories accessible by the Toolgate component. Look for unexpected files or directories.

ls -l /path/to/toolgate/directory

• macos: Monitor system logs (Console.app) for unusual file access attempts or errors related to the Toolgate component. Filter for keywords like 'directory traversal' or 'path manipulation'. • macos: Use ktrace to trace system calls made by the Toolgate process and identify suspicious file access patterns.

ktrace -p <toolgate_process_id>

• macos: Examine the Autoruns registry keys associated with Parallels Desktop for any unusual or unexpected entries that might indicate malicious activity.

1. 2024-05-03Disclosure

   disclosure

1. Reserviert2023-02-28
2. Veröffentlicht2024-05-03
3. Geändert2024-09-18
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2023-27326 is to upgrade to a patched version of Parallels Desktop. Parallels has released a fix, and users are strongly advised to apply it as soon as possible. If immediate upgrading is not feasible, consider restricting access to the Toolgate component and implementing strict file access controls. While a direct WAF rule is unlikely to be effective due to the local nature of the vulnerability, monitoring system logs for suspicious file access attempts related to Toolgate can provide early warning signs of potential exploitation. After upgrading, confirm the fix by attempting to access restricted files via the vulnerable path and verifying that access is denied.