Description (CNA)
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a proxy using FixedTarget=false and an upstream HTTP proxy can alter HTTP request/header framing at that upstream proxy.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| FreeRDP / FreeRDP | affected 3.0.0 before 3.32.0; unaffected 3.32.0 |
CWE
CWE-93
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-87v8-2gwr-ww9j
- https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-http-header-injection-via-proxy-routing-token
ADP enrichment
No English description supplied.