FreeRDP versions older than 3.29.0 do not validate CRLF and control characters in the TargetNetAddress field of an RDP redirection PDU. The value is copied into the client’s ServerHostname and, when the client is speaking through an HTTP proxy, is placed directly into the proxy CONNECT request line and Host header without filtering. A malicious or compromised RDP server can therefore send a crafted redirection PDU that injects arbitrary headers or even additional requests into the CONNECT message. This results in an HTTP request injection that can alter the intended use of the proxy and allow unintended traffic to pass through it.

Vendor: FreeRDP; Product: FreeRDP; Affected versions: all releases prior to 3.29.0 (i.e., versions 3.28.0 and below).

The CVSS score of 9.3 signals a critical severity. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a malicious or compromised RDP server that sends a crafted redirection PDU over a network path that includes an HTTP proxy. The client receives the redirection, is forced to use the supplied TargetNetAddress, and the resulting CONNECT request contains injected headers. Exploitation requires control over the RDP server and the client to connect through an HTTP proxy; no local privilege escalation is needed.