SecBoard
Zurück zur CVE-Übersicht

CVE-2026-109245

MEDIUM(6.8)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Risk Signal Score17/100 — NIEDRIG
  • CVSS 6.8 — Mittel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.8

Technische Schwere

Beschreibung

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 3.32.0

Threat-Hunting-Queries

Detects attempts to establish TLS connections without proper certificate validation, specifically targeting the Azure AD authentication flow. This query looks for network connections to 'login.microsoftonline.com' where the TLS handshake might be completed without full server certificate chain verification, which is difficult to detect purely from logs without deep packet inspection or specific ap

Sentinel/Defender KQL

DeviceNetworkEvents
| where RemoteUrl == "login.microsoftonline.com"
| where InitiatingProcessFileName == "FreeRDP.exe" // Adjust process name if different
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
// Further analysis would require deeper TLS inspection logs, which are not typically available in standard endpoint logs.
// Consider looking for network traffic anomalies or specific FreeRDP error logs related to certificate validation.

Splunk SPL

index=* sourcetype=freerdp_logs (OR sourcetype=network_traffic) "login.microsoftonline.com" 
| search (NOT "certificate validated") // Placeholder for actual log indicating lack of validation
| table _time, host, src_ip, dest_ip, dest_url, process
// This query assumes FreeRDP or network devices log details about TLS validation status. 
// Adjust 'sourcetype' and search terms based on actual log formats.

Sigma

title: FreeRDP Improper Certificate Validation
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential FreeRDP connections to login.microsoftonline.com without proper TLS certificate validation.
references:
  - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h44v-39x6-9xvg
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    InitiatingProcessFileName|endswith: 'FreeRDP.exe'
    RemoteUrl|contains: 'login.microsoftonline.com'
  condition: selection
fields:
  - InitiatingProcessFileName
  - RemoteUrl
  - RemoteIp
  - DestinationPort
tags:
  - attack.initial_access
  - cve.2026-109245
  - cwe.295

Elastic ES|QL

from network.connection
| where process.executable.name == "FreeRDP.exe" // Adjust process name if different
| where destination.domain == "login.microsoftonline.com"
| project @timestamp, host.name, process.executable.name, destination.domain, destination.ip, destination.port
// Similar to other platforms, direct detection of 'improper certificate validation' requires specific logging 
// that indicates the TLS handshake completed without verification, which is not standard.

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • login.microsoftonline.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen