CVE-2022-24883: FreeRDP Server authentication might allow invalid credentials to pass
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a SAM file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via HashCallback and/or ensure the SAM database path configured is valid and the application has file handles left.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp2to a version that resolves this vulnerability.Fixed in 2.11.7+dfsg1-6~deb12u1 - Upgrade
Upgrade
debian/freerdp2to a version that resolves this vulnerability.Fixed in 2.7.0+dfsg1-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 2.7.0 - Configuration
As a workaround, use custom authentication via HashCallback and/or ensure the configured SAM database path is valid and the application has file handles available.
FreeRDP Server HashCallback and SAM database path = Use custom authentication via HashCallback and/or configure a valid SAM database path with available file handles
Event History
Frequently Asked Questions
What is CVE-2022-24883?
CVE-2022-24883 is a vulnerability that affects the FreeRDP software prior to version 2.7.0.
How does CVE-2022-24883 affect the FreeRDP software?
CVE-2022-24883 allows for successful server-side authentication against an invalid SAM file path if configured.
Which versions of FreeRDP are affected by CVE-2022-24883?
FreeRDP versions up to but excluding 2.7.0 are affected by CVE-2022-24883.
Are FreeRDP-based clients affected by CVE-2022-24883?
No, FreeRDP based clients are not affected by CVE-2022-24883.
How severe is CVE-2022-24883?
CVE-2022-24883 has a severity rating of 9.8, which is considered critical.
How can I fix CVE-2022-24883?
To fix CVE-2022-24883, users should update to FreeRDP version 2.7.0 or later.
Is there any additional information about CVE-2022-24883?
Yes, more information about CVE-2022-24883 can be found in the references provided: [Reference 1](https://github.com/FreeRDP/FreeRDP/commit/4661492e5a617199457c8074bad22f766a116cdc), [Reference 2](https://github.com/FreeRDP/FreeRDP/commit/6f473b273a4b6f0cb6aca32b95e22fd0de88e144), [Reference 3](https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0).