Heimdall - Host Header Injection & Open Redirect

mediumseverity

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

LinuxServer.io Heimdall 2.6.3-ls307 contains a host header injection caused by improper validation of user-supplied HTTP headers `X-Forwarded-Host` and `Referer`, letting unauthenticated remote attackers perform host header injection and open redirect attacks, exploit requires no special privileges.

Impact

Unauthenticated attackers can redirect users to malicious sites, enabling phishing, UI redress, and session theft.

Fix

Update to the latest version of Heimdall.

How to confirm it

Send: GET /
Positive when: contains "<script src=\"http://interact.sh/" and "Heimdall" AND status 200

Run it with nuclei: nuclei -id CVE-2025-50578 -u <target>

The full check

id: CVE-2025-50578

info:
  name: Heimdall - Host Header Injection & Open Redirect
  author: DhiyaneshDk
  severity: medium
  description: |
    LinuxServer.io Heimdall 2.6.3-ls307 contains a host header injection caused by improper validation of user-supplied HTTP headers `X-Forwarded-Host` and `Referer`, letting unauthenticated remote attackers perform host header injection and open redirect attacks, exploit requires no special privileges.
  impact: |
    Unauthenticated attackers can redirect users to malicious sites, enabling phishing, UI redress, and session theft.
  remediation: |
    Update to the latest version of Heimdall.
  reference:
    - https://github.com/linuxserver/Heimdall/issues/1451
    - https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"Heimdall"
  tags: cve,cve2025,heimdall,redirect,host-header,oos

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-Host: interact.sh

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script src="http://interact.sh/'
          - 'Heimdall'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from