CVE-2023-50228

Executive Summary

CVE-2023-50228 is a local privilege escalation vulnerability in Parallels Desktop, specifically within the Updater service. The flaw stems from improper verification of cryptographic signatures, allowing an attacker with low-privileged code execution on the host to escalate privileges to root. This vulnerability has a CVSS score of 7.8 (High) and is currently unpatched according to available data. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the impact is severe due to full system compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – Requires local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions needed.
• Privileges Required: Low (PR:L) – Attacker needs low-privileged code execution.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not cross trust boundaries.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) – Full system compromise.

Threat Level: High. While exploitation requires local access, the ability to escalate to root makes it critical for multi-user environments or systems with untrusted users.

Deep Dive & Mechanics

The vulnerability resides in the Parallels Desktop Updater service, which is responsible for checking and applying updates. The service fails to properly verify the cryptographic signature of update packages or binaries it processes. This allows an attacker to craft a malicious update payload that, when processed by the updater, executes arbitrary code with root privileges.

Attack Flow:

1. Attacker gains low-privileged code execution on the host (e.g., via a malicious app or user account).
2. Attacker replaces or intercepts an update file (e.g., via a man-in-the-middle attack on local IPC or by modifying a file the updater reads).
3. The updater processes the malicious file without verifying its cryptographic signature.
4. The malicious code executes in the context of root, granting full system control.

The lack of signature verification (CWE-347) is the core issue. The updater likely trusts files from a specific location or channel without validating their authenticity.

Vulnerable vs. Patched Code

Since no patch details are available, we can only describe the vulnerable behavior:

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable updater
void process_update(char *file_path) {
    // No signature verification
    execute_as_root(file_path);
}

Patched Code (Expected):

// Pseudocode for patched updater
void process_update(char *file_path) {
    if (!verify_signature(file_path, trusted_public_key)) {
        log_error("Invalid signature");
        return;
    }
    execute_as_root(file_path);
}

The fix would involve implementing cryptographic signature verification using a trusted public key embedded in the application.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Low-privileged user account on a macOS host running Parallels Desktop.
• Ability to write to a location the updater reads (e.g., /tmp/ or a specific cache directory).

Exploitation Steps:

1. Create a malicious payload that escalates privileges (e.g., a shell script or binary).
2. Replace the legitimate update file with the malicious one.
3. Trigger the updater (e.g., by running prl_update or waiting for a scheduled check).
4. The updater executes the payload as root.

Example Payload (bash):

#!/bin/bash
# This payload creates a root backdoor
echo "root:newpassword" | chpasswd

Triggering the Updater:

# Simulate updater execution (actual path may vary)
sudo /Applications/Parallels\ Desktop.app/Contents/MacOS/prl_update --check

Blue Team

Detection:

• Monitor for unexpected file modifications in updater directories.
• Alert on execution of prl_update with unusual arguments or from non-standard paths.
• Use endpoint detection rules to flag unsigned binaries executed by the updater.

Hunting:

• Search for files in /tmp/ or /Library/Parallels/ with suspicious names or recent modifications.
• Check for processes spawned by prl_update that are not typical update binaries.

Indicators of Compromise (IOCs)

• File Hashes: (None available, but monitor for unknown binaries in updater paths)
• Process Names: prl_update, Parallels Updater
• File Paths:
  • /Applications/Parallels Desktop.app/Contents/MacOS/prl_update
  • /Library/Parallels/
  • /tmp/parallels_update_*
• Network Connections: Outbound connections to suspicious IPs during update checks.
• Registry/Preferences: Modified plist files in ~/Library/Preferences/ related to Parallels.

Detection Engineering

YARA Rule

rule CVE_2023_50228_Parallels_Updater {
    meta:
        description = "Detects malicious files targeting Parallels Desktop Updater"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50228"
    strings:
        $s1 = "prl_update" nocase
        $s2 = "Parallels" nocase
        $s3 = "update" nocase
    condition:
        all of ($s*) and filesize < 10MB
}

Sigma Rule

title: Parallels Desktop Updater Suspicious Execution
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of Parallels Updater with potential privilege escalation
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/prl_update'
        CommandLine|contains: '--check'
    condition: selection
falsepositives:
    - Legitimate update checks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2023-50228 Parallels Updater Suspicious Outbound"; flow:to_server; content:"parallels"; nocase; content:"update"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable automatic updates in Parallels Desktop until a patch is available.
2. Restrict local user permissions to prevent low-privileged code execution.
3. Monitor updater logs for suspicious activity.

Long-Term Fix:

• Apply the official patch from Parallels when released.
• Implement application whitelisting to prevent unauthorized binaries from executing.

Workaround:

• Remove the updater binary if not needed (may break update functionality).
• Use endpoint protection to block execution of unsigned code by the updater.

Valters IT
DevSecOps & Cyber Threat Intelligence