GHSA-6p3w-fv52-cf24: FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion
FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rtsreadauthverifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding to abort the connecting client process.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
FreeRDP client versions from 3.0.0 through versions before 3.32.2 are affected only when built with verbose WinPR assertions enabled. The exposed client must connect through an RD Gateway controlled by an attacker.
What must an attacker do to trigger the issue?
The attacker needs control of the RD Gateway used by the victim client. They can send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding during the connection process, causing the client process to abort.
Are clients affected by default?
The issue is conditional on the client being built with verbose WinPR assertions. The provided information does not state whether those assertions are enabled in default FreeRDP builds.
How can I determine whether a client may be affected?
Check whether the FreeRDP client version is 3.0.0 or later but earlier than 3.32.2, and whether it was built with verbose WinPR assertions. Also identify clients that connect through RD Gateways not fully trusted or controlled by your organization.