GHSA-jq25-3374-4262: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tlsverifycertificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
FreeRDP clients before 3.32.2 are exposed when connecting to an RDP server whose identity can be impersonated by a man-in-the-middle attacker using a certificate issued by a CA trusted by the client.
What does an attacker need to exploit this?
The attacker must be able to position themselves as a man in the middle of the RDP connection and possess a certificate from a CA trusted by the affected client. No client-side privileges or user interaction are required according to the supplied vector.
What could an attacker obtain or alter after a successful bypass?
A successful attacker can intercept the RDP session, including keystrokes, clipboard data, and screen content. The provided impact vector also indicates high impact to confidentiality and integrity.