N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-72h4-mxfc-jx37

GHSA-72h4-mxfc-jx37: Heimdall: Case-sensitive host matching may lead to policy bypass

Summary

Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended.

Note: The issue can only lead to unintended access if heimdall is configured with an "allow all" default rule. Since v0.16.0, heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure flag.

Details

This vulnerability can potentially be exploited by an adversary if rule matching relies on the request host.

For example, consider the following rule:

id: rule-1
match:
  hosts:
    - type: exact
      value: admin.example.com
execute: # configured to require authentication and authorization
  # ...

If an adversary now sends a request with the Host header set to Admin.Example.Com, rule-1 will not be matched, and the following will happen instead:

If no default rule is configured, the request will result in an error (404 Not Found)
If a default rule is configured, it will be executed. If the default rule is configured in an overly permissive way (e.g. allowing anonymous access), this results in a policy bypass.

Impact

Bypass of access control policies enforced by heimdall may lead to the following consequences:

Access to or modification of data that should be restricted
Invocation of functionality that is expected to require authentication or authorization
In certain configurations, escalation of privileges depending on the exposed functionality

Workarounds

Normalize request hosts to lowercase in the layers in front of heimdall.
Do not configure a permissive default rule. Respectively, do not make use of the --insecure or the --insecure-skip-secure-default-rule-enforcement flags.
When using regex type for host matching, expressions shall be defined in a case-insensitive manner (e.g. (?i)^admin\.example\.com$)
Include the ID of the rule expected to be executed in the JWT issued by heimdall and check that value in the consuming project's service.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-72h4-mxfc-jx37

GHSA-72h4-mxfc-jx37:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dadrus/heimdall	go	< 0.17.14	0.17.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-72h4-mxfc-jx37, stems from case-sensitive handling of HTTP hostnames in Heimdall's rule matching logic, which contradicts the case-insensitive nature of hostnames as defined by web standards. This could allow an attacker to bypass access control policies by crafting a request with a hostname that differs only in case from a protected endpoint (e.g., using Admin.Example.Com instead of admin.example.com).

My analysis of the fixing commit 3d05e56a9e7ef0355f17482b4322054af4e85943 pinpointed the exact functions where this flawed logic existed. The core of the vulnerability lies in the failure to normalize the incoming request's hostname to a consistent case (lowercase) before evaluation.

The primary vulnerable functions identified are:

requestcontext.extractURL: This function is the main entry point for processing standard HTTP requests. It failed to normalize the Host header, passing the raw, case-sensitive value to the rule matching engine.
grpcv3.RequestContext.Init: For environments where Heimdall integrates with Envoy, this function serves as the entry point. Similar to extractURL, it used the hostname from the gRPC request without normalization.

The patch applies a simple fix in both functions: converting the hostname to lowercase using strings.ToLower(). This ensures that all subsequent processing and rule matching operations deal with a canonical representation of the hostname.

Additionally, the function rules.ruleFactory.CreateRule was modified to normalize the hostnames defined within the rules configuration itself. This change ensures consistency and correctness in the matching logic, as both the runtime request data and the configuration data are now in the same normalized format. An exploit would involve a request being processed by either extractURL or RequestContext.Init, and the resulting un-normalized host failing to match a rule created by CreateRule, potentially granting unintended access if a permissive default rule is configured.

Vulnerable functions

grpcv3.RequestContext.Init

internal/handler/envoyextauth/grpcv3/request_context.go

This function initializes the request context from an Envoy gRPC request. It was using the 'Host' header from the request directly, without converting it to lowercase. This case-sensitive handling could lead to a mismatch with the rules, causing a policy bypass. The patch fixes this by converting the host to lowercase using 'strings.ToLower()'.

requestcontext.extractURL

internal/handler/requestcontext/extract_url.go

This function extracts the URL from an incoming HTTP request. It was not normalizing the hostname to lowercase before the patch. An attacker could provide a 'Host' header with mixed case to bypass the matching rules. The patch adds 'strings.ToLower(host)' to normalize the hostname.

rules.ruleFactory.CreateRule

internal/rules/rule_factory_impl.go

This function is responsible for creating rules from the configuration. For host matching, it was using the provided host value as-is. This meant that the matching logic itself was case-sensitive. The patch applies 'strings.ToLower()' to the host value from the configuration, ensuring that the comparison with the (now also lowercased) request host is case-insensitive.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.