FreeRDP Path Traversal Vulnerability in Drive Redirection

A path traversal vulnerability has been identified in FreeRDP versions prior to 3.25.0. The issue arises from an off-by-one error in the path traversal filter within the drive channel client file handling. The vulnerability allows a rogue RDP server to read, list, or write files one directory above the client's shared folder by exploiting RDPDR requests. This exploitation requires the victim to have drive redirection enabled.

Impact

Exploitation of this vulnerability allows a rogue RDP server to access files one directory above the client's shared folder, bypassing the intended directory restrictions. This could lead to unauthorized access or modification of files.

Reproduction

To reproduce this vulnerability, connect to a rogue RDP server with drive redirection enabled, using a FreeRDP client version prior to 3.25.0. The server can then issue RDPDR I/O requests that escape the shared drive root by one level, accessing files above the designated shared folder.

Remediation

Users can upgrade to FreeRDP version 3.25.0 or later, where this vulnerability has been patched.