GO-2026-5075: Heimdall: IP Spoofing via Unvalidated Forwarding Headers
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trustedproxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heimdallto a version that resolves this vulnerability.Fixed in 0.17.17
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running Heimdall before version 0.17.17 are affected when the trusted_proxies option is configured. In that configuration, values from Forwarded and X-Forwarded-For are exposed to the rule pipeline as Request.ClientIPAddresses.
What does an attacker need to do to trigger the issue?
An attacker needs to supply Forwarded or X-Forwarded-For header values that reach Heimdall. Malformed IP values, arbitrary strings, RFC 7239 unknown values, and obfuscated identifiers can be accepted; quoted Forwarded values can also be split into unintended fragments.
What can be done if an immediate upgrade is not possible?
Avoid configuring trusted_proxies where possible, because the vulnerable client-IP extraction occurs when that option is configured. Upgrade to version 0.17.17 when feasible.
How can I determine whether my instance is exposed?
Check whether Heimdall is running a version earlier than 0.17.17 and whether trusted_proxies is configured. If both conditions apply, review rules that consume Request.ClientIPAddresses, as they may receive unvalidated forwarding-header values.