Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.17.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
Heimdall, a cloud-native identity-aware proxy and access control service, is affected when it runs in proxy mode. An attacker can send a crafted Host header to inject extra parameters into the Forwarded header, which may allow them to spoof IP addresses seen by upstream services.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- dadrus heimdall
fixed in 0.17.17
- github.com/dadrus/heimdallGo
fixed in 0.17.17