Parallels Desktop Toolgate ディレクトリトラバーサルによるローカル権限昇格の脆弱性

The core of this vulnerability lies in the Toolgate component of Parallels Desktop, where user-supplied paths are not adequately validated before being used in file operations. A successful exploit allows a local attacker, who already possesses the ability to execute high-privileged code within a guest system, to traverse directories and potentially access sensitive files or execute arbitrary commands. This privilege escalation could grant the attacker complete control over the affected macOS host system. While the initial access requires high-privileged code execution within the guest, the subsequent escalation can have a significant impact on the host environment, potentially leading to data breaches, system compromise, and further lateral movement within the network.

Users of Parallels Desktop running version 18.0.2 (53077) on macOS are at direct risk. This includes individuals and organizations utilizing Parallels Desktop for running virtual machines, particularly those with less stringent security practices or those who routinely grant high privileges to guest operating systems.

• macos: Use ls -l to check file permissions and ownership in directories accessible by the Toolgate component. Look for unexpected files or directories.

ls -l /path/to/toolgate/directory

• macos: Monitor system logs (Console.app) for unusual file access attempts or errors related to the Toolgate component. Filter for keywords like 'directory traversal' or 'path manipulation'. • macos: Use ktrace to trace system calls made by the Toolgate process and identify suspicious file access patterns.

ktrace -p <toolgate_process_id>

• macos: Examine the Autoruns registry keys associated with Parallels Desktop for any unusual or unexpected entries that might indicate malicious activity.

1. 2024-05-03Disclosure

   disclosure

1. 予約済み2023-02-28
2. 公開日2024-05-03
3. 更新日2024-09-18
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2023-27326 is to upgrade Parallels Desktop to a patched version. Parallels has released an update addressing this vulnerability; refer to their official advisory for the specific version number. If immediate patching is not feasible, consider implementing stricter file access controls within the guest operating system to limit the attacker's ability to exploit the vulnerability. While a WAF or proxy is unlikely to directly mitigate this local privilege escalation, ensuring robust access controls within the guest environment can reduce the attack surface. After upgrading, verify the fix by attempting to access restricted files or directories using manipulated paths; the operation should be denied.