Critical flaw reported Parallels Desktop, PoC released
Take action: You can't do much to fix your Parallels Desktop since there is no patch. Instead, work on prevention - limit access to your computer only to yourself or to very few very trusted people, and when using Parallels use only trusted installer packages that are downloaded from reputable locations and you have verified the integrity of the file (hash comparison).
Learn More
A critical vulnerability is reported in Parallels Desktop that bypasses the previous patch for CVE-2024-34331 (CVSS score 9.8).
The vulnerability is a root privilege escalation flaw discovered by security researcher Mickey Jin (@patch1t), who released details and proof-of-concept exploits after Parallels failed to address the issue for over seven months despite multiple responsible disclosure attempts.
The vulnerability exists in the repack_osx_install_app.sh script, which is responsible for repackaging macOS installer applications. The script implements a code signature verification mechanism to ensure the createinstallmedia binary is Apple-signed, but two significant security bypasses were identified:
- TOCTOU (Time of Check to Time of Use) Vulnerability: Allows attackers to swap the legitimate createinstallmedia tool with a malicious version after signature verification but before root privilege execution
- Signature Verification Bypass: The "anchor apple" verification requirement is insufficiently strict, enabling attackers to inject malicious dynamic libraries into Apple-signed binaries
The researcher developed two proof-of-concept exploits demonstrating the vulnerability:
- The first exploit targets the do_repack_createinstallmedia function, enabling arbitrary command execution with root privileges by replacing the createinstallmedia binary with a malicious payload.
- The second exploit, introduced with Parallels 19.4.1, abuses the do_repack_manual functionality to:
- Control macOS image repackaging destination paths
- Manipulate symbolic links to redirect root-owned folders
- Insert malicious code into the 7z extraction process, resulting in root-privileged execution
The flaw was initially reported to Zero Day Initiative (ZDI) in May 31, 2024, then in July 22, 2024 a new repack command line issue reported directly to Parallels. After initial acknowledgment, Parallels ceased communication despite follow-up attempts
The vulnerability remains unpatched potentially affecting all current versions of Parallels Desktop. No official CVE or CVSS score has been assigned yet due to the 0-day nature of the disclosure.
As this is an active 0-day vulnerability with no available patch, users should exercise caution when using Parallels Desktop, when handling macOS installer applications.
