CVE-2018-6651

Vulnerability

The vulnerability resides in the uncurl_ws_accept function of the uncurl library before version 0.07, as used in Parsec before version 140-3. The function performs insufficient Origin header validation by accepting an arbitrary substring match, allowing an attacker to craft a WebSocket request from a malicious domain that passes the check [1].

Exploitation

To exploit the vulnerability, an attacker must lure a victim to a website hosted on a specially formatted domain name under the attacker's control. The victim's browser must be capable of executing JavaScript and making WebSocket connections. When the browser attempts to establish a WebSocket connection to the Parsec client, the insufficient Origin validation allows the attacker's crafted request to be accepted, bypassing intended access restrictions [1].

Impact

Successful exploitation grants the attacker full control over the Parsec client. On Windows systems, this translates to full control over the victim's computer, as Parsec is a remote desktop application. On other platforms (e.g., macOS, Linux), the attacker can still control the client and, through creative use of the API, achieve a similar degree of compromise. Additionally, the attacker can grant themselves further permissions (e.g., escalate from view-only to full access), forcefully disconnect active remote users, and retrieve sensitive information from the victim's device [1].

Mitigation

The vulnerability is patched in Parsec version 140-3 and uncurl version 0.07. Users should upgrade to these or later versions. No workarounds are available; upgrading is the only mitigation [1].