A vulnerability in the Dadrus Heimdall Identity Aware Proxy allows unauthenticated attackers to bypass security rules due to improper URL encoding.

The application incorrectly encodes query parameters when processing requests via the envoy gRPC decision API, causing path expressions to fail matching. An unauthenticated attacker can leverage this encoding mismatch to bypass intended access control policies if the service is running with insecure configurations.

The potential for unauthorized access to protected resources represents a significant security risk, as it undermines the primary function of the Identity Aware Proxy. Given the CVSS score of 8.2, this vulnerability could lead to data exposure or unauthorized actions within the environment. If Heimdall is configured with an allow all default rule, the impact is elevated, potentially granting attackers access to sensitive internal services that were intended to be restricted.

Immediate Action: Upgrade to Heimdall version 0.17.11 or later to implement the corrected URL encoding logic.

Proactive Monitoring: Review access logs for unusual patterns involving URL encoded characters or unexpected access to restricted paths.

Compensating Controls: Ensure that the secure default rule enforcement is active and that flags such as --insecure-skip-secure-default-rule-enforcement or --insecure are disabled in the production environment.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to infrastructure security by potentially nullifying access control decisions. Administrators are advised to prioritize the upgrade to version 0.17.11 immediately. In environments where an immediate patch is not feasible, verify that secure default rule enforcement is strictly enabled to minimize the attack surface.