Parsec Cloud UNC Path Vulnerability Leading to NTLM Hash Retrieval

A vulnerability exists in Parsec Cloud versions prior to 3.3.3-rc.0 due to improper sanitization of workspace names. This flaw allows workspace names to include backslashes, potentially creating a Universal Naming Convention (UNC) path. When such a path is mounted in the Windows filesystem, the application may become unresponsive if the path is invalid. However, if the path is valid, the system will interact with the resource, enabling an attacker to capture NTLM authentication hashes.

Impact

Exploitation of this vulnerability allows for interception of NTLM hashes from the authenticated user.

Reproduction

To reproduce this vulnerability, create a new workspace in Parsec Cloud with a UNC path as the name, such as '\\192.168.1.3\test'. After sharing the workspace with targeted organization members, their Parsec application will automatically mount the workspace. If the UNC path is invalid, the application will freeze. If valid, it will interact with the UNC resource, allowing NTLM hash retrieval.

Remediation

Users can update to Parsec Cloud version 3.3.3-rc.0 or later to address this vulnerability.