Skip to content
Threat Feed

Vendor

Dadrus

3 briefs RSS
high advisory

Heimdall Authorization Bypass via Case-Sensitive URL-Encoded Slash Handling

Heimdall versions before 0.17.14 are vulnerable to inconsistent path interpretation due to case-sensitive handling of URL-encoded slashes; when `allow_encoded_slashes` is set to `off` (the default), the lowercase `%2f` is not recognized, potentially leading to authorization bypass if the default rule is overly permissive and the upstream service interprets `%2f` as a path separator.

Heimdall authorization-bypass url-encoding
2r 1t
high advisory

Heimdall Host Matching Case-Sensitivity Vulnerability

Heimdall performs case-sensitive host matching, which can lead to policy bypass because HTTP hostnames are case-insensitive, potentially leading to unauthorized access, data modification, or privilege escalation if the request host is part of the rule.

heimdall defense-evasion policy-bypass access-control
2r 1t
high advisory

Heimdall Authorization Bypass via Path Normalization Mismatch

Heimdall is vulnerable to an authorization bypass due to a path normalization mismatch between Heimdall and downstream components, potentially leading to unauthorized access and privilege escalation.

heimdall authorization-bypass path-normalization cloud
2r 2t