Heimdall: IP Spoofing via Unvalidated Forwarding Headers
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.17.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Heimdall, a cloud native Identity Aware Proxy and Access Control Decision service, is affected when its trusted_proxies option is configured. Attackers can supply arbitrary or malformed client IP values through the Forwarded and X-Forwarded-For headers, which Heimdall passes to its rule pipeline unvalidated, potentially allowing IP-based access control decisions to be bypassed or misled.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- dadrus heimdall
fixed in 0.17.17
- https://github.com/dadrus/heimdallGo
fixed in 0.17.17
- github.com/dadrus/heimdallGo
fixed in 0.17.17