Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/f4dee-backup/cve-2025-54123
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlLearning & Education
GitHubf4dee-backup/cve-2025-54123

CVE-2025-54123

Proof-of-concept exploit for CVE-2025-54123, a critical authenticated command injection in Hoverfly <= 1.11.3, enabling remote code execution via the middleware API endpoint.

View Repository
25 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-54123 - Hoverfly Command Injection (RCE)

PoC CVE-2025-54123 - Middleware Command Injection in Hoverfly

📌 CVE Details

  • ID: CVE-2025-54123
  • Type: Command Injection / Remote Code Execution (RCE)
  • Vendor: Hoverfly
  • Impact: Allows authenticated attackers to execute arbitrary system commands via the middleware API endpoint.
  • Affected Versions: Hoverfly ≤ 1.11.3
  • More Info:
    • GHSA-r4h8-hfp2-ggmf
    • [NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-54123]

⚙️ Description

This vulnerability affects Hoverfly versions ≤ 1.11.3 and specifically targets the /api/v2/hoverfly/middleware endpoint. It is caused by insufficient input validation and sanitization in multiple files, including middleware.go, local_middleware.go, and . User-controlled input provided to the parameter is passed directly to a system binary (e.g., ) without proper checks, allowing with the privileges of the Hoverfly process.

hoverfly_service.go
script
/bin/bash
Remote Command Execution (RCE)
  • CVSS v3.1 Score: 9.8 (CRITICAL) — high impact, low attack complexity.
  • Impact: An authenticated attacker can execute arbitrary commands on the underlying system, potentially leading to full system compromise.
  • Mitigation: In versions ≥ 1.12.0, the affected middleware API is disabled by default. Users are strongly advised to upgrade or restrict access to the middleware endpoint.

🚀 Usage

🔧 Requirements

  • curl

📥 Installation

root@kitploit:~
git clone https://github.com/f4dee-backup/CVE-2025-54123
root@kitploit:~
cd CVE-2025-54123
root@kitploit:~
chmod +x CVE-2025-54123.sh

🧪 Help Panel

root@kitploit:~
./CVE-2025-54123.sh -h

 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ███████╗      ███████╗██╗  ██╗ ██╗██████╗ ██████╗
██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗██╔════╝      ██╔════╝██║  ██║███║╚════██╗╚════██╗
██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝███████╗█████╗███████╗███████║╚██║ █████╔╝ █████╔╝
██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚════██║╚════╝╚════██║╚════██║ ██║██╔═══╝  ╚═══██╗
╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗███████║      ███████║     ██║ ██║███████╗██████╔╝
 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝╚══════╝      ╚══════╝     ╚═╝ ╚═╝╚══════╝╚═════╝
Hoverfly <= 1.11.3 - Authenticated Middleware Command Injection

[?] Parameters description:

	-t    Target base URL (e.g., http://target:8888)
	-u    Valid username
	-p    Valid password
	-c    Command to execute (must be enclosed in double quotes)
	-h    Show this help panel

[i] Example:
./CVE-2025-54123.sh -t http://target.com:8888 -u admin -p password -c "id"

⚠️ Notes

  • Authentication is required to obtain a valid token.
  • Multiple failed authentication attempts may trigger temporary blocking depending on internal configuration.
  • Behavior may vary depending on deployment (e.g., Docker vs native).

⚠️ Disclaimer

This exploit is intended for educational and authorized security testing purposes only.

Do NOT use this against systems without explicit permission. Unauthorized access may be illegal.

The author assumes no responsibility for misuse or any damage caused.

Download Tool