CVE-2024-6240: Parallels Desktop Privilege Escalation Flaw

CVE-2024-6240 Overview

CVE-2024-6240 is an improper privilege management vulnerability affecting Parallels Desktop Software versions earlier than 19.3.0. This vulnerability allows an attacker to inject malicious code through a script by manipulating the BASH_ENV environment variable, pointing it to a malicious script that executes during application startup. Successful exploitation enables privilege escalation on the affected macOS system.

Critical Impact

This vulnerability allows complete system compromise through privilege escalation, potentially giving attackers full control over the host macOS system running Parallels Desktop.

Affected Products

• Parallels Desktop for macOS (versions prior to 19.3.0)
• All Parallels Desktop installations on macOS using vulnerable versions
• Systems with Parallels Desktop configured with default startup behavior

Discovery Timeline

• 2024-06-21 - CVE-2024-6240 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6240

Vulnerability Analysis

This vulnerability stems from improper privilege management (CWE-269) within Parallels Desktop's handling of environment variables during application startup. The core issue lies in how the application processes the BASH_ENV environment variable without proper validation or sanitization. When Parallels Desktop launches, it executes shell initialization scripts, and if an attacker has set the BASH_ENV variable to point to a malicious script, that script executes with elevated privileges.

The attack can be performed remotely without requiring authentication or user interaction, and the scope is changed, meaning a successful exploit can impact resources beyond the vulnerable component's security scope. This allows attackers to escape the virtualization boundary and affect the host macOS system.

Root Cause

The root cause is improper privilege management in how Parallels Desktop handles environment variables during startup sequences. The application fails to properly sanitize or validate the BASH_ENV environment variable before executing shell scripts, allowing arbitrary script execution. This design flaw enables attackers to inject malicious code into the application's initialization process, bypassing normal security controls.

Attack Vector

The attack exploits Parallels Desktop's startup behavior by leveraging the BASH_ENV environment variable. An attacker can create a malicious script containing arbitrary commands and configure the BASH_ENV variable to reference this script's path. When Parallels Desktop starts and initializes its shell environment, it sources the script pointed to by BASH_ENV, executing the attacker's code with elevated privileges.

The attack flow involves:

1. Creating a malicious script containing privilege escalation commands
2. Setting the BASH_ENV environment variable to the malicious script's path
3. Triggering Parallels Desktop startup (or waiting for system reboot/application restart)
4. The malicious script executes during initialization with elevated privileges
5. Attacker gains escalated access to the host macOS system

For detailed technical information about this vulnerability, see the INCIBE Security Notice.

Detection Methods for CVE-2024-6240

Indicators of Compromise

• Unexpected values in the BASH_ENV environment variable pointing to non-standard script locations
• Suspicious scripts in user-writable directories that are referenced by environment variables
• Unusual process spawning during Parallels Desktop startup
• Evidence of privilege escalation attempts in system logs

Detection Strategies

• Monitor for modifications to environment variables, particularly BASH_ENV, in user profiles and system-wide configurations
• Implement file integrity monitoring on Parallels Desktop installation directories
• Review startup scripts and environment configurations for unauthorized changes
• Deploy endpoint detection rules to identify suspicious script execution during application startup

Monitoring Recommendations

• Enable verbose logging for Parallels Desktop and monitor for anomalous behavior during startup
• Configure alerts for environment variable modifications in user shell profiles (.bashrc, .bash_profile, .zshrc)
• Monitor process execution chains originating from Parallels Desktop for unexpected child processes
• Implement SentinelOne's behavioral AI to detect privilege escalation patterns associated with environment variable manipulation

How to Mitigate CVE-2024-6240

Immediate Actions Required

• Upgrade Parallels Desktop to version 19.3.0 or later immediately
• Audit current BASH_ENV environment variable settings across all systems running Parallels Desktop
• Review and remove any suspicious scripts that may have been placed for exploitation
• Restrict write access to directories commonly used for environment variable script paths

Patch Information

Parallels has addressed this vulnerability in Parallels Desktop version 19.3.0. Organizations should prioritize updating all Parallels Desktop installations to this version or later. The update patches the improper privilege management issue by implementing proper validation and sanitization of environment variables during application startup.

Workarounds

• If immediate patching is not possible, restrict user ability to modify environment variables at the system level
• Implement application whitelisting to prevent unauthorized script execution
• Consider temporarily disabling Parallels Desktop on critical systems until patching can be completed
• Use endpoint protection solutions like SentinelOne to monitor and block suspicious privilege escalation attempts

# Verify Parallels Desktop version
/Applications/Parallels\ Desktop.app/Contents/MacOS/prl_client_app --version

# Check for suspicious BASH_ENV settings
echo $BASH_ENV
grep -r "BASH_ENV" ~/.bash* ~/.zsh* /etc/profile /etc/bashrc 2>/dev/null

# Update Parallels Desktop via command line (if Parallels Tools available)
# Or download the latest version from Parallels website