A critical vulnerability in FreeRDP allows a malicious server to inject arbitrary HTTP headers and requests, potentially leading to unauthorized operations when connecting through an HTTP proxy.

The software fails to validate CRLF and control characters within the TargetNetAddress field of RDP redirection packets. This allows an attacker to manipulate the HTTP CONNECT request line and headers when the client routes traffic through a proxy.

The CVSS score of 9.8 reflects the high potential for request splitting and header injection attacks. This could allow an attacker to hijack proxy connections, perform cross-protocol attacks, or bypass security controls enforced at the proxy level.

Immediate Action: Update the FreeRDP client to version 3.29.0 or later.

Proactive Monitoring: Monitor proxy logs for suspicious or malformed CONNECT requests originating from FreeRDP clients.

Compensating Controls: Restrict or disable HTTP proxy usage for RDP connections if the update cannot be applied immediately, or ensure the proxy is configured to reject requests with invalid header characters.

Public Exploit Available: Unknown

Due to the critical nature of this injection vulnerability, users of FreeRDP should upgrade to version 3.29.0 as soon as possible. Maintaining current versions is essential to defend against sophisticated network-based attacks.