Parallels RAS Client Local Privilege Escalation via RDP Backend

Executive Summary

This vulnerability is a local privilege escalation flaw in Parallels RAS Client. It exists in the RAS RDP Backend Service due to an exposed dangerous function. Attackers with low-privileged code execution can exploit it to gain SYSTEM-level privileges and execute arbitrary code.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for the Parallels RAS Client version and monitoring the RAS RDP Backend Service. Verify if the installed version is below 21.2. Check running services for 'RAS RDP Backend Service' and inspect for unusual privilege escalation attempts.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to elevate their privileges to SYSTEM level on affected systems. This could lead to full control over the system, enabling installation of malware, data theft, or further network compromise. However, attackers must already have some access to the system to exploit it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to escalate privileges to SYSTEM level, enabling arbitrary code execution with high privileges. Such privilege escalation could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized SYSTEM-level access could result in data breaches or unauthorized modifications, directly impacting compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Parallels RAS Client to version 21.2 or later. If updating is not possible, restrict local access to the RAS RDP Backend Service and monitor for suspicious activity. Apply principle of least privilege to limit attack surface.

Useful 0 Not Useful 0