FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured

Summary

The FreeRDP proxy enables external certificate management for its outbound target connection. Its certificate callback accepts the target certificate when no proxy module vetoes it. A network-positioned attacker can therefore impersonate the configured RDP target with a self-signed, wrong-hostname certificate. In a live proxy replay, the default no-module configuration sent 395 post-TLS RDP bytes; a required rejecting module sent zero.

Prerequisites

The deployment uses the FreeRDP proxy with TLS to its target and has no module that validates and rejects the presented target certificate. The attacker must receive or intercept the proxy's outbound connection, and a user must initiate a proxied session.

Remediation

No upstream fix was found in current master. Recommended remediation is normal chain and hostname verification for the outbound target, or fail-closed external management that requires an explicit verifier decision.