Not sure I understand how this attack works. You ask for cert for foo.com, LE tells you to provide a self-signed cert subjectAlt=foo.bar.acme.invalid. LE resolves foo.bar to some heroku endpoint as the domain lives on heroku, LE connects via TLS without verification and sends foo.bar.acme.invalid as SNI, which heroku routes to a hijacker who asked heroku to route foo bar.acme.invalid requests?
Why would LE send the SNI in the first place? I thought the purpose was to prove you own the domain, not cohabit an environment where the domain is hosted?
I guess it only allows hijacking certs of domains running on heroku et al envs?
Also, what do host headers have to do with this? Presumably this is just a tls handshake test?