FreeRDP versions before 3.29.0 do not sanitize CRLF and control characters in the server‑controlled TargetNetAddress field of an RDP redirection PDU. The value is copied directly into the client’s ServerHostname and, if the client connects through an HTTP proxy, is inserted unfiltered into the proxy CONNECT request line and Host header by http_proxy_connect(). This enables a malicious or compromised RDP server to inject arbitrary headers or whole requests into the HTTP proxy CONNECT request, creating a form of HTTP request injection. The weakness is classified as CWE‑113 and can potentially allow an attacker to issue unintended requests through the proxy, leading to information disclosure, session hijacking, or remote code execution on the proxy or victim systems.

Vendor: FreeRDP; Product: FreeRDP; Affected versions: all releases prior to 3.29.0 (i.e., versions 3.28.0 and below).

The CVSS score of 9.3 signals a critical severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is that a malicious or compromised RDP server sends a crafted redirection PDU over a network path that includes an HTTP proxy. The client receives the redirection, is forced to use the supplied TargetNetAddress, and the resulting CONNECT request contains injected headers. Exploitation requires the attacker to control or control the RDP server and for the client to connect through an HTTP proxy; no local privilege escalation is needed.