PT-2021-19301 · Parallels · Parallels Desktop

Ezrak1E · Published 2021-04-21 · Updated 2021-05-10 · CVE-2021-31421

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Parallels Desktop version 16.1.1-49141

Description This issue allows local attackers to delete arbitrary files on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Toolgate component, resulting from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to delete arbitrary files in the context of the hypervisor.

Recommendations For Parallels Desktop version 16.1.1-49141, consider disabling the Toolgate component until a patch is available to prevent exploitation. Restrict access to the Toolgate component to minimize the risk of arbitrary file deletion. Avoid using user-supplied paths in file operations within the Toolgate component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-31421

ZDI-21-425

Affected Products

Parallels Desktop

References · 5

• https://osv.dev/vulnerability/CVE-2021-31421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31421 · Security Note
• https://kb.parallels.com/en/125013 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-425 · Security Note
• https://t.me/cvenotify/13940 · Telegram Post