Parallels Desktop Toolgate 目录遍历本地权限提升漏洞

该漏洞的潜在影响非常严重。攻击者首先需要在目标虚拟机上执行高权限代码，然后利用此漏洞提升权限，从而可能完全控制受影响的 macOS 系统。攻击者可以读取敏感数据、修改系统配置，甚至执行恶意代码。由于 Parallels Desktop 广泛应用于各种场景，包括开发、测试和运行 Windows 虚拟机，因此该漏洞的潜在影响范围非常广。类似于其他目录遍历漏洞，攻击者可以利用此漏洞访问系统文件，绕过安全控制，并最终获得对系统的完全控制权。

Users of Parallels Desktop running version 18.0.2 (53077) on macOS are at direct risk. This includes individuals and organizations utilizing Parallels Desktop for running virtual machines, particularly those with less stringent security practices or those who routinely grant high privileges to guest operating systems.

• macos: Use ls -l to check file permissions and ownership in directories accessible by the Toolgate component. Look for unexpected files or directories.

ls -l /path/to/toolgate/directory

• macos: Monitor system logs (Console.app) for unusual file access attempts or errors related to the Toolgate component. Filter for keywords like 'directory traversal' or 'path manipulation'. • macos: Use ktrace to trace system calls made by the Toolgate process and identify suspicious file access patterns.

ktrace -p <toolgate_process_id>

• macos: Examine the Autoruns registry keys associated with Parallels Desktop for any unusual or unexpected entries that might indicate malicious activity.

1. 2024-05-03Disclosure

   disclosure

1. 已保留2023-02-28
2. 发布日期2024-05-03
3. 修改日期2024-09-18
4. EPSS 更新日期2026-04-02

官方建议立即更新至修复版本。如果无法立即更新，可以尝试以下缓解措施：限制对 Toolgate 组件的访问权限，确保虚拟机运行在隔离的环境中，并定期审查系统日志以检测可疑活动。由于没有提供修复版本，因此这些缓解措施旨在降低风险，但不能完全消除漏洞的影响。建议密切关注 Parallels 官方发布的更新和安全公告，并及时采取行动。