FreeRDP RDSTLS Server Pre-Auth Bypass: Accepting Uncredentialed Capabilities PDU

Vulnerability Overview RDSTLS Server Authentication Bypass: Acceptance of Capabilities PDU without credentials during the authentication step (fail-open ) Description: FreeRDP's server-side RDSTLS handshake dispatches incoming PDUs solely based on the attacker-provided , without verifying whether the PDU is required by the protocol at the current step. The object is -zeroed, and its starts at 0, which corresponds to . Problem: When the server is waiting for a client authentication request, the client can send a Capabilities-PDU (a PDU containing credentials) instead of . This validates certain constant fields and returns without setting the . The state machine continues, and the server sends an with set to . Consequently, returns "authenticated," bypassing the evaluation of the password, redirection GUID, or auto-reconnect cookie. Result: This constitutes a pre-authentication bypass on any FreeRDP-based server/proxy with RDSTLS enabled. An unauthenticated remote client can reach a state where the server considers the client authenticated. Affected Versions Affected versions: - FreeRDP master (HEAD) - FreeRDP 3.x (including 3.2.7.1) - Accessible when the server is configured with Remediation Temporary workaround: Disable (the default value) or add a secondary authentication gate in the server's login callback. Proof of Concept (POC) Code ```dockerfile FROM ubuntu:24.04 ENV DEBIAN_FRONTEND=noninteractive Pinned commit: current upstream HEAD of the default branch. ARG TARGET_COMMIT=5e8e987b3aafaa85afcf091c0f9458 ARG CLANG_VERSION=20 RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates git cmake ninja-build pkg-config make \ libssl-dev zlib1g-dev openssl python3 \ wget g++ libgl1-mesa-dev software-properties-common \ && wget -qO /tmp/lvm.sh https://apt.llvm.org/lvm.sh && chmod +x /tmp/lvm.sh && /tmp/lvm.sh && /tmp/lvm.sh -y $CLANG_VERSION \ && apt-get install -y --no-install-recommends clang-$CLANG_VERSION llvm-$CLANG_VERSION libclang-$CLANG_VERSION \ && rm -rf /var/lib/apt/lists/* ENV CC=clang-20 CXX=clang++-20 Cacheable clone, then a separate checkout so the build can be re-pinned to any commit via --build-arg TARGET_COMMIT RUN git clone https://github.com/FreeRDP/FreeRDP /src/repo WORKDIR /src/repo RUN git checkout $TARGET_COMMIT Deployment configuration only (does not touch the vulnerable libfreerdp/core/rdstls.c): 1. Enable the default-false RdstlsSecurity setting so the sample server negotiates RDSTLS, and configure a RedirectionGuid so the server has a real credential to enforce (vs the reproducible wrong-credential rejection next to the credential-less bypass). 2. Configure a wrong-credential rejection next to the credential-less bypass. COPY configure_server.py /tmp/configure_server.py RUN python3 /tmp/configure_server.py /tmp/configure_server.py && grep -iE "FreeRDP_RdstlsSecurity, TRUE Logstash bug -> ASAN not required. Build the server + sample server only. RUN cmake -DBUILD_TESTING=OFF -DWITH_SSE2=OFF -DWITH_SSE3=OFF \ -DWITH_CLIENT=ON -DWITH_CLIENT_COMMON=ON -DWITH_CLIENT_CHANNELS=ON \ -DWITH_CLIENT_INTERFACE=ON -DWITH_SERVER=ON -DWITH_SERVER_CHANNELS=ON \ -DWITH_SERVER_INTERFACE=ON -DWITH_SHADOW=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_INTERFACE=ON -DWITH_SHADOW_CHANNELS=ON \ -DWITH_SHADOW_I

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP RDSTLS Server Pre-Auth Bypass: Accepting Uncredentialed Capabilities PDU

More from this source