CVE-2023-45894

The error consists of a lack of proper segmentation (isolation) of virtualized applications from the host server environment. An attacker without any authentication, acting remotely over the network, can apply techniques known as kiosk breakout — escape methods known from restricted kiosk/terminal environments — to break out of the virtualized application context and gain access to the underlying system. As a result, arbitrary commands can be executed on the server (RCE).

An attacker can take full control of the server, gaining the ability to read and modify data, install malicious software, and further spread within the organization's infrastructure (lateral movement).

Parallels Remote Application Server must be immediately updated to version 19.2.23975 or later. Details are available in the vendor's references and in the researchers' report at the address indicated in the CVE references section.

Parallels Remote Application Server (RAS) in all versions prior to 19.2.23975