{"record":{"id":"96b57e76f781fcfd","repo":"shadow1ng/fscan","slug":"unsupported-version","errorCode":null,"errorMessage":"Unsupported version","messagePattern":"Unsupported version","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/gcc/gcc.go","lineNumber":515,"sourceCode":"}\ntype ServerCertificate struct {\n\tDwVersion uint32\n\tCertData  CertData\n}\n\nfunc (sc *ServerCertificate) Unpack(r io.Reader) error {\n\tsc.DwVersion, _ = core.ReadUInt32LE(r)\n\tvar cd CertData\n\tswitch CertificateType(sc.DwVersion & 0x7fffffff) {\n\tcase CERT_CHAIN_VERSION_1:\n\t\tglog.Debug(\"ProprietaryServerCertificate\")\n\t\tcd = &ProprietaryServerCertificate{}\n\tcase CERT_CHAIN_VERSION_2:\n\t\tglog.Debug(\"X509CertificateChain\")\n\t\tcd = &X509CertificateChain{}\n\tdefault:\n\t\tglog.Error(\"Unsupported version:\", sc.DwVersion&0x7fffffff)\n\t\treturn errors.New(\"Unsupported version\")\n\t}\n\tif cd != nil {\n\t\terr := cd.Unpack(r)\n\t\tif err != nil {\n\t\t\tglog.Error(\"Unpack:\", err)\n\t\t\treturn err\n\t\t}\n\t}\n\tsc.CertData = cd\n\n\treturn nil\n}\n\ntype ServerSecurityData struct {\n\tEncryptionMethod  uint32 `struc:\"little\"`\n\tEncryptionLevel   uint32 `struc:\"little\"`\n\tServerRandomLen   uint32 //0x00000020\n\tServerCertLen     uint32","sourceCodeStart":497,"sourceCodeEnd":533,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/gcc/gcc.go#L497-L533","documentation":"ServerCertificate.Unpack in gcc.go parses the server's certificate blob carried in the GCC Server Security Data during the RDP connection sequence. The DwVersion field must be CERT_CHAIN_VERSION_1 (proprietary) or CERT_CHAIN_VERSION_2 (X.509); any other value hits the default branch and returns this error. It means the library cannot decode the certificate format the server sent.","triggerScenarios":"The 32-bit DwVersion field of the server certificate, masked with 0x7fffffff (the top bit is the CA-issued flag), decodes to a value other than 1 (CERT_CHAIN_VERSION_1) or 2 (CERT_CHAIN_VERSION_2) while parsing the server's GCC conference create response.","commonSituations":"Connecting to a non-Microsoft or non-standard RDP server (xrdp, FreeRDP-based gateways, custom VDI brokers) that emits a different certificate version; a corrupted or desynchronized stream so the wrong 4 bytes are read as DwVersion; hitting a newer server implementation with a certificate version this library does not know.","solutions":["Verify the target is a standard Microsoft RDP server; test with mstsc or FreeRDP to confirm the handshake format.","Dump the raw bytes (glog already prints the version) and check the stream is not desynchronized earlier in the GCC block parse.","Add a case for the unsupported version in gcc.go ServerCertificate.Unpack, implementing a CertData Unpack for that format.","If security policy allows, downgrade the server to use standard PROPRIETARYCHAIN (version 1) or X509 (version 2) certificates."],"exampleFix":"// before\ncase CERT_CHAIN_VERSION_2:\n    glog.Debug(\"X509CertificateChain\")\n    cd = &X509CertificateChain{}\ndefault:\n    return errors.New(\"Unsupported version\")\n// after\ncase CERT_CHAIN_VERSION_2:\n    cd = &X509CertificateChain{}\ncase 3: // version added by target server\n    cd = &X509CertificateChain{}\ndefault:\n    return fmt.Errorf(\"Unsupported version: %d\", sc.DwVersion&0x7fffffff)","handlingStrategy":"validation","validationCode":"// Check server cert version support before/at connect time by catching the parse:\nif dwVersion&0x7fffffff != 1 && dwVersion&0x7fffffff != 2 {\n    return fmt.Errorf(\"server certificate version %d unsupported by client\", dwVersion&0x7fffffff)\n}","typeGuard":null,"tryCatchPattern":"client.On(\"error\", func(err error) {\n    if strings.Contains(err.Error(), \"Unsupported version\") {\n        // fall back to a server/protocol known to use X.509 or proprietary certs\n    }\n})","preventionTips":["Target standard Microsoft RDP endpoints which use CERT_CHAIN_VERSION_1 or _2.","Keep the grdp fork updated for new server certificate formats.","Log DwVersion on failure to identify server implementations needing new parsers."],"tags":["rdp","certificate","protocol-parsing","unsupported-version"],"backgroundTag":"unsupported-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}