CVE-2023-45894: Parallels RAS RCE Vulnerability

CVE-2023-45894 Overview

CVE-2023-45894 is a critical Remote Code Execution vulnerability affecting Parallels Remote Application Server (RAS) versions prior to 19.2.23975. The vulnerability stems from a fundamental architectural flaw where the Remote Application Server fails to properly segment virtualized applications from the underlying server infrastructure. This design weakness enables remote attackers to leverage standard kiosk breakout techniques to escape the virtualized application environment and achieve arbitrary code execution on the host server.

Critical Impact

Remote attackers can achieve full remote code execution on the host server by exploiting inadequate application segmentation, potentially compromising the entire virtualization infrastructure and all hosted applications.

Affected Products

• Parallels Remote Application Server versions prior to 19.2.23975
• All deployments using unsegmented virtualized application configurations
• Enterprise environments utilizing Parallels RAS for application delivery

Discovery Timeline

• 2023-12-14 - CVE-2023-45894 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-45894

Vulnerability Analysis

This vulnerability represents a severe architectural flaw in Parallels Remote Application Server's virtualization isolation model. The core issue lies in the inadequate segmentation between virtualized applications and the underlying server infrastructure. In a properly configured application virtualization environment, published applications should execute within a sandboxed context that prevents users from accessing the host operating system or server resources.

However, in vulnerable versions of Parallels RAS, this segmentation is either absent or insufficiently enforced, allowing attackers to employ kiosk breakout techniques—methods traditionally used to escape restricted desktop environments—to gain access to the underlying server.

The attack surface is particularly concerning because it requires no authentication and can be exploited remotely over the network. A successful exploit grants the attacker the ability to execute arbitrary code on the server with the privileges of the RAS service, potentially leading to complete system compromise, lateral movement within the network, and access to sensitive data processed by all virtualized applications.

Root Cause

The root cause of CVE-2023-45894 is the absence of proper isolation boundaries between virtualized applications and the host server environment. Parallels RAS failed to implement adequate security controls to prevent users of published applications from interacting with server-level resources. This architectural oversight means that standard user interface elements, dialog boxes, or application functionalities can be abused to break out of the intended application context and gain shell access to the underlying system.

Attack Vector

The attack leverages network-accessible Remote Application Server services. An attacker connects to a published application through the Parallels RAS client infrastructure. Once connected, the attacker exploits the lack of application segmentation by using kiosk breakout techniques. These techniques typically involve:

• Exploiting file dialogs to navigate the file system and execute arbitrary binaries
• Using help menus or embedded browser functionality to access system resources
• Leveraging clipboard functionality or print dialogs to interact with system components
• Abusing application-specific features that inadvertently expose shell access

Since virtualized applications run on the server, successful breakout provides the attacker with code execution capabilities on the RAS server itself, not just the client machine.

The vulnerability can be exploited without authentication and requires no user interaction, making it a prime target for automated attacks against exposed Parallels RAS deployments.

Detection Methods for CVE-2023-45894

Indicators of Compromise

• Unexpected process execution originating from Parallels RAS service contexts
• Unusual file system access patterns from virtualized application sessions, particularly access to system directories
• Evidence of shell commands or PowerShell execution within RAS session contexts
• Anomalous network connections originating from the RAS server to internal or external destinations
• Log entries indicating attempts to access restricted system resources from published applications

Detection Strategies

• Monitor Parallels RAS server processes for child process spawning that deviates from normal application behavior
• Implement application whitelisting on RAS servers to detect unauthorized binary execution
• Deploy endpoint detection and response (EDR) solutions on RAS servers to identify breakout attempts
• Review RAS session logs for patterns consistent with file dialog exploitation or system navigation attempts
• Configure SIEM alerts for unusual authentication or privilege escalation events on RAS infrastructure

Monitoring Recommendations

• Enable verbose logging for all Parallels RAS components and centralize log collection
• Implement network segmentation monitoring to detect lateral movement attempts from compromised RAS servers
• Deploy file integrity monitoring on RAS server system directories to detect unauthorized modifications
• Establish baseline behavior profiles for published applications and alert on deviations

How to Mitigate CVE-2023-45894

Immediate Actions Required

• Upgrade Parallels Remote Application Server to version 19.2.23975 or later immediately
• Audit all published applications for potential kiosk breakout vectors
• Restrict network access to RAS servers using firewall rules and network segmentation
• Implement additional access controls and monitoring on RAS infrastructure pending upgrade
• Review server logs for any evidence of prior exploitation attempts

Patch Information

Parallels has addressed this vulnerability in Remote Application Server version 19.2.23975. This update implements proper segmentation between virtualized applications and the host server, preventing kiosk breakout attacks. Organizations should prioritize this update as the vulnerability carries the maximum CVSS score and can be exploited remotely without authentication.

For detailed technical information about this vulnerability, refer to the Oracle Security CVE Resource on GitHub.

Workarounds

• Implement strict application whitelisting on RAS servers to prevent execution of unauthorized binaries
• Configure published applications to run with minimal privileges and restricted file system access
• Deploy Group Policy restrictions to disable access to file dialogs, help systems, and other common breakout vectors
• Consider temporarily disabling external access to RAS services until patching is complete
• Implement network-level restrictions to limit what compromised RAS sessions can access

# Example: Restrict RAS server network access pending patch
# Block outbound connections from RAS server except essential services
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -j DROP

# Monitor for suspicious process execution
# Enable Windows Security auditing for process creation
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable