CVE-2024-54189

Executive Summary

CVE-2024-54189 is a privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (build 55740). The flaw resides in the Snapshot functionality, where a root service writes to a file owned by a normal user. By leveraging a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation. The CVSS score is 7.8 (High), and the attack vector is local. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation in a desktop virtualization application.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is high due to the low complexity and the potential for full system compromise.

Deep Dive & Mechanics

The vulnerability is in the Snapshot functionality of Parallels Desktop. When a snapshot is taken, a root service writes to a file that is owned by a normal user. An attacker can exploit this by creating a hard link to an arbitrary file. When the root service writes to the file, it follows the hard link and writes to the attacker-chosen file, leading to privilege escalation.

The core issue is a classic symlink/hard link race condition (CWE-59: Improper Link Resolution Before File Access). The root service does not properly verify that the file it is writing to is not a hard link to a sensitive file.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the Snapshot service of Parallels Desktop 20.1.1. The fix would involve the root service checking that the file it writes to is not a hard link, or using a secure temporary file creation method.

Exploitation & Lab Setup

Red Team

No public exploit code is available. The following is a conceptual exploit:

# Create a hard link to a sensitive file (e.g., /etc/sudoers)
ln /path/to/victim/file /tmp/target_file

# Trigger the snapshot functionality
prlctl snapshot "VM Name" --name "exploit"

# The root service writes to /tmp/target_file, which is a hard link to /etc/sudoers
# This can lead to privilege escalation

Blue Team

To detect exploitation attempts:

1. Monitor for unusual hard link creation to sensitive files.
2. Monitor the Snapshot service for unexpected file writes.
3. Use file integrity monitoring (FIM) on critical system files.

Indicators of Compromise (IOCs)

• File System: Unexpected hard links to sensitive files (e.g., /etc/sudoers, /etc/passwd).
• Process: Unusual writes by the Parallels Snapshot service to user-owned files.
• Logs: Entries in system logs indicating unexpected file modifications.

Detection Engineering

YARA Rule

rule CVE_2024_54189_Hard_Link_Exploit {
    meta:
        description = "Detects hard link creation to sensitive files for CVE-2024-54189"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54189"
    strings:
        $sensitive_path = "/etc/sudoers" or "/etc/passwd" or "/etc/shadow"
        $hard_link_cmd = "ln " ascii nocase
    condition:
        $hard_link_cmd and $sensitive_path
}

Sigma Rule

title: CVE-2024-54189 Hard Link Exploit Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects hard link creation to sensitive files for CVE-2024-54189
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54189
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/ln'
        CommandLine|contains:
            - '/etc/sudoers'
            - '/etc/passwd'
            - '/etc/shadow'
    condition: selection
falsepositives:
    - Legitimate system administration
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-54189 Hard Link Exploit"; content:"ln "; content:"/etc/sudoers"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Patch: No patch is currently available. Monitor Parallels for updates.
• Mitigation: Restrict local user access to the system. Use file integrity monitoring on critical files. Disable the Snapshot functionality if not needed.
• Workaround: None available.

Valters IT