Parallels RAS Client Local Privilege Escalation via RDP Backend

Executive Summary

This is a local privilege escalation vulnerability in Parallels RAS Client. It allows attackers with low-privileged code execution to escalate privileges to SYSTEM level by exploiting an exposed dangerous function in the RAS RDP Backend Service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Parallels RAS Client version is prior to 21.2. Use commands like 'rasclient --version' or check installed programs via 'wmic product get name,version' on Windows. Monitor for unusual privilege escalation attempts in system logs.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full control of your system, install malware, steal data, or perform other malicious actions with SYSTEM privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to escalate privileges to SYSTEM level, which could lead to unauthorized access to sensitive data or system functions. Such privilege escalation risks may violate compliance requirements under GDPR or HIPAA if exploited to access protected health information or personal data without authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Update Parallels RAS Client to version 21.2 or later to address the vulnerability. Ensure the RAS RDP Backend Service is not exposed to untrusted users or networks.

Useful 0 Not Useful 0