Heimdall
Monthly
Client-IP spoofing in dadrus Heimdall (versions up to and including 0.17.16) lets remote attackers inject arbitrary strings, malformed IP literals, RFC 7239 'unknown' values and obfuscated identifiers into Request.ClientIPAddresses whenever the optional trusted_proxies setting is enabled, because the Forwarded (for=) and X-Forwarded-For values are never checked for syntactic validity and the Forwarded parser splits on ',' and ';' without honoring quoted strings. The practical consequence is deployment-dependent: rules that consume ClientIPAddresses (for example a CEL authorizer using networks() for IP-range checks, or a Remote authorizer forwarding the client IP) can be made to evaluate against attacker-chosen values, and in proxy mode the injected values are passed upstream unchanged in X-Forwarded-For/Forwarded headers. Exploitation is gated on non-default configuration (trusted_proxies), on attacker influence over the forwarding headers, and for the access-control path on rules actually referencing ClientIPAddresses; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, with remediation available in 0.17.17.
Forwarded-header injection in Heimdall (dadrus/heimdall) proxy mode up to and including 0.17.16 lets an unauthenticated remote attacker place commas and semicolons into the Host header so that Heimdall copies them verbatim into the RFC 7239 Forwarded header it sends upstream, producing attacker-controlled for= entries that can appear to originate from trusted addresses such as 127.0.0.1 or 10.0.0.1. This is a conditional, chained access-control-bypass flaw rather than a direct compromise of the proxy: Heimdall itself suffers no confidentiality, integrity or availability impact, and impact only materializes when an upstream service parses Forwarded per RFC 7239 and makes IP-based trust or allowlist decisions on the for= value on its own rather than relying on Heimdall's access-control capabilities. No authentication is required, no public exploit code was confirmed at time of analysis (the advisory supplies a curl-based proof-of-concept reference), and version 0.17.17 fixes the issue by hardening Host, Forwarded and X-Forwarded-For handling.
Authorization bypass in Heimdall cloud-native Identity Aware Proxy allows remote unauthenticated attackers to circumvent access control policies via path normalization mismatches. Attackers can craft requests with encoded or relative path traversal sequences (e.g., /public/../admin, /user/%2e%2e/admin) that Heimdall evaluates against one rule while downstream services normalize to a different protected path, enabling unauthorized access to restricted resources or functionality. No public exploit identified at time of analysis, though CVSS vector indicates network-accessible, low-complexity exploitation (CVSS:4.0 AV:N/AC:L/PR:N). Fixed in version 0.17.14.
Heimdall's case-sensitive host matching bypasses access control policies when attackers submit HTTP requests with alternate letter casing in the Host header, exploiting the discrepancy between HTTP spec (case-insensitive hostnames) and Heimdall's implementation. Versions prior to 0.17.14 fail to match rules configured for lowercase hostnames when requests arrive with mixed or uppercase casing, potentially routing to permissive default rules and granting unintended access. This vulnerability is most dangerous when Heimdall is deployed with insecure default rule enforcement flags enabled, though it requires attackers to know the exact hostname pattern and exploit misconfiguration.
Authorization bypass in Heimdall cloud-native Identity Aware Proxy affects versions prior to 0.17.14 due to case-sensitive URL-encoded slash handling. Remote unauthenticated attackers can craft requests with lowercase-encoded slashes (%2f) to evade path-based access controls when 'allow_encoded_slashes' is disabled (default). This discrepancy between Heimdall's path interpretation and upstream services enables access to restricted endpoints if a permissive default rule exists. GitHub reports a public fix (PR #3207, commit 8b0de6a) with patched version 0.17.14 released. No public exploit identified at time of analysis. CVSS 7.8 with CVSS:4.0 vector indicates network-accessible, low-complexity attack requiring no privileges or user interaction, though real-world impact depends on deployment configuration.
Server-side request forgery in LinuxServer Heimdall through 2.8.3 lets an unauthenticated attacker coerce the server into issuing HTTP requests to arbitrary internal hosts and ports, including the cloud metadata address 169.254.169.254, by inducing a victim with network reachability to the instance to load attacker-controlled content that triggers the CSRF-reachable POST /test_config or GET /get_stats endpoints (CVSS 3.1 base score 3.4, vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the author scopes the CSRF exposure to only 'some realistic installations' where those endpoints are reachable. The realistic impact is a status/port oracle plus partial response data - not full response exfiltration - and the cloud-metadata path additionally requires Heimdall to run on an instance exposing an unauthenticated metadata service.
Server-Side Request Forgery in MITRE SAF Heimdall 2.11.6 through 2.13.x allows unauthenticated remote attackers to reach internal network hosts by supplying an arbitrary host_url parameter to the Tenable proxy endpoint, which the backend forwards without validation. The root cause is the absence of both authentication guards and URL allowlist enforcement on the /tenable proxy route, as confirmed by the fix commit adding JwtAuthGuard and an origin-based allowlist. No public exploit code and no CISA KEV entry are identified at time of analysis, limiting immediate real-world risk despite the network-accessible, no-authentication attack vector.
Client-IP spoofing in dadrus Heimdall (versions up to and including 0.17.16) lets remote attackers inject arbitrary strings, malformed IP literals, RFC 7239 'unknown' values and obfuscated identifiers into Request.ClientIPAddresses whenever the optional trusted_proxies setting is enabled, because the Forwarded (for=) and X-Forwarded-For values are never checked for syntactic validity and the Forwarded parser splits on ',' and ';' without honoring quoted strings. The practical consequence is deployment-dependent: rules that consume ClientIPAddresses (for example a CEL authorizer using networks() for IP-range checks, or a Remote authorizer forwarding the client IP) can be made to evaluate against attacker-chosen values, and in proxy mode the injected values are passed upstream unchanged in X-Forwarded-For/Forwarded headers. Exploitation is gated on non-default configuration (trusted_proxies), on attacker influence over the forwarding headers, and for the access-control path on rules actually referencing ClientIPAddresses; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, with remediation available in 0.17.17.
Forwarded-header injection in Heimdall (dadrus/heimdall) proxy mode up to and including 0.17.16 lets an unauthenticated remote attacker place commas and semicolons into the Host header so that Heimdall copies them verbatim into the RFC 7239 Forwarded header it sends upstream, producing attacker-controlled for= entries that can appear to originate from trusted addresses such as 127.0.0.1 or 10.0.0.1. This is a conditional, chained access-control-bypass flaw rather than a direct compromise of the proxy: Heimdall itself suffers no confidentiality, integrity or availability impact, and impact only materializes when an upstream service parses Forwarded per RFC 7239 and makes IP-based trust or allowlist decisions on the for= value on its own rather than relying on Heimdall's access-control capabilities. No authentication is required, no public exploit code was confirmed at time of analysis (the advisory supplies a curl-based proof-of-concept reference), and version 0.17.17 fixes the issue by hardening Host, Forwarded and X-Forwarded-For handling.
Authorization bypass in Heimdall cloud-native Identity Aware Proxy allows remote unauthenticated attackers to circumvent access control policies via path normalization mismatches. Attackers can craft requests with encoded or relative path traversal sequences (e.g., /public/../admin, /user/%2e%2e/admin) that Heimdall evaluates against one rule while downstream services normalize to a different protected path, enabling unauthorized access to restricted resources or functionality. No public exploit identified at time of analysis, though CVSS vector indicates network-accessible, low-complexity exploitation (CVSS:4.0 AV:N/AC:L/PR:N). Fixed in version 0.17.14.
Heimdall's case-sensitive host matching bypasses access control policies when attackers submit HTTP requests with alternate letter casing in the Host header, exploiting the discrepancy between HTTP spec (case-insensitive hostnames) and Heimdall's implementation. Versions prior to 0.17.14 fail to match rules configured for lowercase hostnames when requests arrive with mixed or uppercase casing, potentially routing to permissive default rules and granting unintended access. This vulnerability is most dangerous when Heimdall is deployed with insecure default rule enforcement flags enabled, though it requires attackers to know the exact hostname pattern and exploit misconfiguration.
Authorization bypass in Heimdall cloud-native Identity Aware Proxy affects versions prior to 0.17.14 due to case-sensitive URL-encoded slash handling. Remote unauthenticated attackers can craft requests with lowercase-encoded slashes (%2f) to evade path-based access controls when 'allow_encoded_slashes' is disabled (default). This discrepancy between Heimdall's path interpretation and upstream services enables access to restricted endpoints if a permissive default rule exists. GitHub reports a public fix (PR #3207, commit 8b0de6a) with patched version 0.17.14 released. No public exploit identified at time of analysis. CVSS 7.8 with CVSS:4.0 vector indicates network-accessible, low-complexity attack requiring no privileges or user interaction, though real-world impact depends on deployment configuration.
Server-side request forgery in LinuxServer Heimdall through 2.8.3 lets an unauthenticated attacker coerce the server into issuing HTTP requests to arbitrary internal hosts and ports, including the cloud metadata address 169.254.169.254, by inducing a victim with network reachability to the instance to load attacker-controlled content that triggers the CSRF-reachable POST /test_config or GET /get_stats endpoints (CVSS 3.1 base score 3.4, vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the author scopes the CSRF exposure to only 'some realistic installations' where those endpoints are reachable. The realistic impact is a status/port oracle plus partial response data - not full response exfiltration - and the cloud-metadata path additionally requires Heimdall to run on an instance exposing an unauthenticated metadata service.
Server-Side Request Forgery in MITRE SAF Heimdall 2.11.6 through 2.13.x allows unauthenticated remote attackers to reach internal network hosts by supplying an arbitrary host_url parameter to the Tenable proxy endpoint, which the backend forwards without validation. The root cause is the absence of both authentication guards and URL allowlist enforcement on the /tenable proxy route, as confirmed by the fix commit adding JwtAuthGuard and an origin-based allowlist. No public exploit code and no CISA KEV entry are identified at time of analysis, limiting immediate real-world risk despite the network-accessible, no-authentication attack vector.