PT-2022-25595 · Parallels · Parallels Remote Application Server

Published 2022-11-22 · Updated 2022-11-26 · CVE-2022-40870

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parallels Remote Application Server version 18.0

Description The issue allows attackers to execute arbitrary commands via a crafted payload injected into the Host header, which is a result of a Host Header Injection attack. This enables attackers to potentially gain unauthorized access and control over the system.

Recommendations For Parallels Remote Application Server version 18.0, consider restricting access to the Web Client until a patch is available, and avoid using the Web Client with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-40870

Affected Products

Parallels Remote Application Server

References · 6

• 🔥 https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txt · Exploit
• 🔥 https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServer · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40870 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40870 · Vendor Advisory
• https://t.me/cvenotify/38279 · Telegram Post
• https://t.me/cvenotify/38515 · Telegram Post