FreeRDP before version 3.29.0 (specifically versions <= 3.28.0) fails to validate CRLF and control characters in the TargetNetAddress field of the server-controlled RDP redirection. This field is copied into the client's ServerHostname and, when the client uses an HTTP proxy, is written unfiltered into the proxy CONNECT request line and Host header by the http_proxy_connect() function. This allows a malicious or compromised RDP server to send a crafted redirection PDU containing embedded control characters that can inject arbitrary headers or requests into the HTTP proxy CONNECT request, representing a CWE-113 (Improper Neutralization of CRLF Sequences) vulnerability. The CVSS v3.1 score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a malicious or compromised RDP server to inject arbitrary HTTP headers or requests into the proxy CONNECT request when the client connects through an HTTP proxy. This can lead to HTTP request smuggling or other proxy manipulation attacks, potentially compromising the confidentiality, integrity, and availability of communications passing through the proxy.

A fix is available in FreeRDP version 3.29.0. Users should upgrade to version 3.29.0 or later to address this vulnerability. Until patched, avoid connecting through HTTP proxies when using vulnerable FreeRDP versions or use alternative secure connection methods. Patch status is not explicitly stated in vendor advisories here, so verify with the official FreeRDP project for the latest remediation guidance.