CVE-2023-50226

Executive Summary

CVE-2023-50226 is a local privilege escalation vulnerability in Parallels Desktop, a popular virtualization software for macOS. The flaw resides in the Updater service, which runs with root privileges. By exploiting a symbolic link (symlink) following weakness (CWE-59), a local attacker with low-privileged code execution on the host can abuse the Updater to move arbitrary files to arbitrary locations. This can lead to privilege escalation to root and arbitrary code execution in the root context. The vulnerability was reported via ZDI (ZDI-CAN-21227) and has a CVSS score of 7.8 (High). No public exploit code or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a commercial desktop application (Parallels Desktop) and its built-in Updater service. Supply chain risks are limited to the integrity of the Parallels Desktop installer and update mechanism.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond low-privileged code execution.
• Privileges Required (PR): Low (L) – The attacker needs low-privileged code execution on the host.
• User Interaction (UI): None (N) – No user interaction is required beyond the initial compromise.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Full file system access as root.
• Integrity (I): High (H) – Ability to modify system files.
• Availability (A): High (H) – Potential to disrupt system operations.

Threat Level: High. Local privilege escalation to root in a widely used virtualization product poses significant risk in multi-user environments or after initial compromise.

Deep Dive & Mechanics

The vulnerability is a classic symlink following issue in the Parallels Desktop Updater service. The Updater runs with root privileges to perform software updates. It likely performs file operations (e.g., moving or copying update files) without properly checking if the target path is a symbolic link.

Attack Flow:

1. An attacker gains low-privileged code execution on the host (e.g., via a malicious application or user account).
2. The attacker identifies a file operation performed by the Updater service that moves a file from a source location to a destination location.
3. The attacker creates a symbolic link at the destination location pointing to a critical system file (e.g., /etc/sudoers, /usr/bin/sudo, or a launch daemon plist).
4. When the Updater service performs the file move, it follows the symlink and overwrites the target system file with the attacker-controlled content.
5. The attacker can then leverage the modified system file to escalate privileges to root (e.g., by adding a sudoers entry or replacing a binary).

Root Cause: The Updater service does not validate that the destination path is not a symbolic link before performing file operations. This is a common CWE-59 (Improper Link Resolution Before File Access) vulnerability.

Vulnerable vs. Patched Code

No patch details are available. The vulnerable code is likely in the Parallels Desktop Updater binary (e.g., prl_update_service or similar). A patched version would include checks to prevent following symlinks, such as:

• Using O_NOFOLLOW flag when opening files.
• Resolving the real path of the destination before writing.
• Verifying that the destination is not a symlink using lstat().

Vulnerable Code (Conceptual):

// Vulnerable: follows symlinks
move_file(source, dest) {
    rename(source, dest); // If dest is a symlink, it follows it
}

Patched Code (Conceptual):

// Patched: checks for symlinks
move_file(source, dest) {
    struct stat st;
    if (lstat(dest, &st) == 0 && S_ISLNK(st.st_mode)) {
        // Handle symlink case (e.g., remove or abort)
        unlink(dest);
    }
    rename(source, dest);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local low-privileged code execution on macOS host.
• Parallels Desktop installed with vulnerable Updater service.

Exploitation Steps:

1. Identify the Updater's file operation: Monitor the Updater service (e.g., using fs_usage or ktrace) to find a file move operation. Common targets might be /tmp/ or /Library/Parallels/ directories.
2. Create a symlink: Once the destination path is known, create a symlink pointing to a critical system file.

   ln -s /etc/sudoers /path/to/updater/destination
   

3. Trigger the update: Force the Updater to perform the file move (e.g., by simulating an update check or waiting for a scheduled update).
4. Escalate privileges: After the Updater overwrites the target file, use the modified file to gain root access. For example, if /etc/sudoers was overwritten, add a line to grant sudo access.

   echo "attacker ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
   

5. Execute commands as root:

   sudo -u root /bin/bash
   

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team

Detection:

• Monitor for unusual symlink creation in directories used by the Parallels Updater (e.g., /tmp/, /Library/Parallels/).
• Alert on file operations by the Updater service that target sensitive system files (e.g., /etc/sudoers, /usr/bin/).
• Use endpoint detection and response (EDR) to detect process injection or file system anomalies.

Prevention:

• Apply the vendor patch when available.
• Restrict low-privileged user access to the system.
• Use macOS System Integrity Protection (SIP) to protect critical files.
• Implement application whitelisting to prevent unauthorized code execution.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected symlinks in /tmp/ or /Library/Parallels/ pointing to system files.
  • Modified system files (e.g., /etc/sudoers, /usr/bin/sudo).
• Process:
  • Parallels Updater service (prl_update_service or similar) performing file operations on sensitive paths.
• Network:
  • Unusual outbound connections from the Updater service (if exploited to download malicious payloads).
• Logs:
  • macOS unified logs showing symlink creation or file modification events.
  • sudo logs showing unexpected privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2023_50226_Parallels_Symlink {
    meta:
        description = "Detects symlink creation targeting Parallels Updater paths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50226"
    strings:
        $symlink_cmd = "ln -s" nocase
        $parallels_path = "/Library/Parallels" nocase
        $tmp_path = "/tmp/" nocase
        $sudoers = "/etc/sudoers" nocase
    condition:
        $symlink_cmd and ($parallels_path or $tmp_path) and $sudoers
}

Sigma Rule

title: CVE-2023-50226 Parallels Desktop Symlink Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects symlink creation targeting Parallels Updater paths for privilege escalation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50226
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/ln'
        CommandLine|contains|all:
            - '-s'
            - '/etc/sudoers'
            - '/Library/Parallels'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2023-50226 Parallels Desktop Updater Potential C2"; flow:to_server,established; content:"Parallels"; http_user_agent; content:"update"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Vendor Patch: Check for updates from Parallels and apply the latest version as soon as it becomes available.
2. Restrict Local Access: Limit user accounts to only those necessary. Use the principle of least privilege.
3. Monitor File System: Enable file integrity monitoring (FIM) on critical system files and directories used by Parallels.
4. Disable Updater (Temporary): If the Updater is not critical, disable it to prevent exploitation.

   sudo launchctl unload /Library/LaunchDaemons/com.parallels.desktop.updater.plist
   

Long-Term Mitigations:

• Implement application control to block unauthorized code execution.
• Use macOS security features like SIP, Gatekeeper, and Notarization.
• Regularly audit system for unauthorized symlinks and file modifications.
• Educate users about the risks of running untrusted software.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.