ANT-2026-TAV704VS: .rdp file lines injected as CLI options enabling command execution

freerdp_client_parse_rdp_file_buffer_int() at client/common/file.c:938 appends any .rdp line beginning with '/' to file->args, which is later passed wholesale to freerdp_client_settings_parse_command_line() (file.c:~2605). This exposes every CLI switch to the .rdp author, including /rdp2tcp:, which causes channels/rdp2tcp/client/rdp2tcp_main.c:97-108 to call CreateProcessA() on the attacker-controlled string during VirtualChannelEntryEx — before any TCP/TLS handshake. The rdp2tcp channel is built by default and argv[1] ending in .rdp is auto-parsed, so a victim merely opening an emailed .rdp file gets one-click arbitrary command execution. Additional injectable primitives include /cert:ignore, /drive:root,/ and /action-script.

Target

Project: freerdp/freerdp
Location: client/common/file.c:938
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The .rdp parser falls back to treating any unmatched '/'-prefixed line as a raw argv option with no allowlist, collapsing the trust boundary between an externally-delivered interchange file and local command-line configuration. Because /rdp2tcp: is a valid CLI option whose value is handed straight to CreateProcessA()/fork+execve during pre-connect channel load, the .rdp author gains arbitrary local command execution with no server-side or TLS gating.

Reproduction

1. file.c:938-943 appends any '/'-prefixed .rdp line verbatim to file->args via freerdp_client_add_option()
2. file.c:2600-2610 passes file->args to freerdp_client_settings_parse_command_line() — the full CLI parser
3. cmdline.c:5574-5577 accepts /rdp2tcp: and stores it in FreeRDP_RDP2TCPArgs
4. cmdline.c:6386-6402 adds and loads the rdp2tcp static channel when FreeRDP_RDP2TCPArgs is set
5. freerdp.c:135 → utils_reload_channels() → LoadChannels runs BEFORE rdp_client_connect() (pre-TLS)
6. client.c:1548 invokes the channel's VirtualChannelEntryEx during load
7. rdp2tcp_main.c:310 → init_external_addin() → rdp2tcp_main.c:97-108 passes the attacker string directly to CreateProcessA()
8. On POSIX, winpr process.c:216,313 performs fork()+execve() on it

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Suggested Fix

Do not interpret unrecognised .rdp content as command-line switches; restrict .rdp parsing strictly to the documented Microsoft key:type:value grammar and ignore all other lines (or apply an explicit allowlist of safe options).

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-TAV704VS.

Reference: ANT-2026-TAV704VS
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

Summary

FreeRDP's .rdp connection-file parser treats any line beginning with / as a raw command-line option and appends it verbatim to the argument vector later handed to the full CLI parser (freerdp_client_settings_parse_command_line). The documented .rdp grammar is strictly name:type:value (the Microsoft interchange format); this /-prefixed fallback is not documented in the FreeRDP man page or user manual — which show CLI options only after the file on the command line (xfreerdp connection.rdp /p:… /f) — and it silently exposes the entire xfreerdp option surface to whoever authored the file.

The concrete consequences, in rough order of how hard they are to dismiss as "intended," are:

• /cert:ignore — silent TLS-validation bypass. A .rdp file can disable certificate checking with no prompt, so a victim connecting to a man-in-the-middled or spoofed server gets no warning. There is no legitimate reason an interchange file should be able to silently weaken the client's transport security.
• /drive:... — local filesystem exposure. A .rdp file can mount the user's local directories into the (attacker-controlled) remote session.
• /rdp2tcp:<command> — local command execution. The rdp2tcp channel is designed to launch a helper process, so its argument goes straight to CreateProcessA() (POSIX: fork()+execve()). Because channel loading happens inside freerdp_connect() before the TCP/TLS handshake, merely opening the file runs an attacker-named local command — no server, no certificate, no authentication, even if no RDP server exists. This is the most severe outcome but also the one most easily read as "that option is meant to spawn a process"; the report is really about the file → full-CLI exposure that makes it (and the two above) reachable from an untrusted file. The /rdp2tcp variant additionally requires the channel to be compiled in (OFF in the bare upstream cmake default, but ON in Debian/Ubuntu packaging); the /cert:ignore and /drive variants are present in every client build.

Note on FreeRDP reacting to this

• Deprecation of arbitrary CLI parsing: The behavior where /-prefixed lines in a .rdp file are forwarded to the CLI parser will be disabled by default in the next (=3.28.0) release and is officially marked for complete removal in a future major version. FreeRDP already supports the /args-from parameter for users who explicitly intend to load command-line arguments from a local file (or stdin).

• Untrusted paradigm for .rdp files: Because .rdp files are widespread, standard and expected default options must continue to work. However, we recognize that even standard properties (such as drive redirection drivestoredirect) can be used maliciously to expose local data. Unless a .rdp file is signed and verified via a trusted chain, it must be treated as untrusted. For future versions, we will be discussing a model where only a "safe default set" of options is allowed automatically, while risky or potentially problematic options will require an explicit confirmation (such as a specific command-line flag provided by the user). Signature verification isn't implemented yet.

• /rdp2tcp: The ability for a .rdp file to spawn a helper process via /rdp2tcp is a possible risk. With the argument parsing disabled this should be mitigated. We will be adding a build-time notice regarding this behavior and are planning a future architecture rewrite. On a long term our goal is to deprecate the external binary requirement entirely and move toward an internal tunneling mechanism (similar to SSH -L and -R port forwarding). We've already add a deprecation warning for the next release.

Compatibility

With 3.28.0 the option has been disabled by default, use -DWITH_EMBEDDED_CLI_IN_RDP_FILES=ON to enable this behavior again.