Heym Token Leakage via Header Spoofing Before v0.0.112

Executive Summary

This vulnerability in Heym before v0.0.112 allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers to capture capability tokens from reviewer notifications, which are then used to submit decisions under the owner's credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for suspicious Origin or X-Forwarded-Host headers in requests to heym services. Check logs for workflow notifications containing attacker-controlled domains. Verify if build_public_base_url() uses client headers without validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could capture tokens from review links and gain unauthorized access to approve, refuse, or edit workflow outputs using your credentials. This could lead to data leaks, unauthorized actions, or workflow manipulation without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing tokens that grant control over workflows handling confidential information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade heym to v0.0.112 or later. Ensure capability-bearing URLs are built from server-side configuration like FRONTEND_URL. Validate Origin and X-Forwarded-Host headers against a CORS allowlist. Audit related call sites in files.py, boards.py, and file_intake.py.

Useful 0 Not Useful 0