CVE-2022-39347

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.9.0

Description The issue is related to the missing path canonicalization and base path check for the drive channel in FreeRDP, allowing a malicious server to trick a FreeRDP-based client into reading files outside the shared directory. This can enable a remote attacker to gain unauthorized access to protected information. Users unable to upgrade should avoid using the /drive, /drives, or +home-drive redirection switch to minimize the risk.

Recommendations For versions prior to 2.9.0, upgrade to version 2.9.0 or later to address the issue. As a temporary workaround, consider not using the /drive, /drives, or +home-drive redirection switch until a patch is applied.