REDHAT-BUG-2510004: Medium severity FreeRDP vulnerability
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by httpproxyconnect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0 - Compensating control
If clients must connect through an HTTP proxy, restrict/monitor HTTP proxy CONNECT requests so that only allowed destination hostnames are permitted, mitigating header/request injection from the proxy CONNECT request line and Host header.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients at version 3.28.0 or earlier are affected when they connect through an HTTP proxy. The issue is triggered by an RDP server redirection value being incorporated into the proxy CONNECT request and Host header.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to compromise, an RDP server that a client connects to. The server must send a crafted redirection PDU with control characters in the TargetNetAddress field.
How can I determine whether a client is affected?
Check whether the deployed FreeRDP version is 3.28.0 or earlier and whether the client uses an HTTP proxy for RDP connections. Systems running FreeRDP before 3.29.0 in that configuration should be treated as affected.