PT-2020-14671 · Parallels · Parallels Remote Application Server

Published 2020-07-24 · Updated 2023-01-20 · CVE-2020-15860

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parallels Remote Application Server (RAS) version 17.1.1

Description The issue is a Business Logic Error that allows remote code execution. It enables an authenticated user to execute any application in the backend operating system through the web application, even if the affected application is not published. Furthermore, it is possible to access any host in the internal domain, regardless of whether it has published applications or if the host is no longer associated with the server farm.

Recommendations For Parallels Remote Application Server (RAS) version 17.1.1, consider restricting access to the web application to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the execution of applications in the backend operating system to only those that are necessary and published. Additionally, restrict access to internal domain hosts to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-15860

Affected Products

Parallels Remote Application Server

References · 5

• 🔥 https://coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15860 · Security Note
• https://kb.parallels.com/en/125112 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15860 · Vendor Advisory
• https://parallels.com/products/ras/remote-application-server · Note