CVE-2022-24883

What it actually does

The vulnerability allows successful server-side authentication against an invalid SAM file path, permitting invalid credentials to authenticate successfully in FreeRDP-based RDP servers.

Why it matters to the business

Attackers can gain unauthorized remote access to systems relying on FreeRDP for SAM-based authentication, leading to potential data breaches or system compromise. The issue has been public for over four years with low but persistent exploit probability.

How an attack unfolds

An attacker initiates an RDP connection to a vulnerable server configured with an invalid SAM database path. By supplying any credentials, the flawed authentication logic accepts them as valid due to the path error, bypassing normal checks.

How to fix it

Upgrade FreeRDP to version 2.7.0 or later, specifically commit 40ee5d3bcc70343af6c0300d71968858c1f1948f. Alternatively, implement custom authentication via HashCallback and validate the SAM database path.

How to confirm the fix worked

Verify the FreeRDP version is 2.7.0 or newer. Test authentication with invalid credentials against a properly configured SAM path to confirm failures.

Typical attack path

1. Initiate RDP connection to target server
2. Provide arbitrary or invalid credentials
3. Exploit invalid SAM path to bypass authentication
4. Gain authenticated session access

How to detect it

Examine RDP server logs for successful authentications following failed credential attempts or unexpected SAM path errors. Look for connections from untrusted sources that bypass normal auth flows.

What your security team should do

• Immediately upgrade all FreeRDP instances to the fixed commit.
• Review and correct SAM file path configurations.
• Implement monitoring for authentication anomalies.
• Consider disabling SAM-based auth if not required.