CVE-2025-54123 - Hoverfly Command Injection (RCE)

PoC CVE-2025-54123 - Middleware Command Injection in Hoverfly

📌 CVE Details

• ID: CVE-2025-54123
• Type: Command Injection / Remote Code Execution (RCE)
• Vendor: Hoverfly
• Impact: Allows authenticated attackers to execute arbitrary system commands via the middleware API endpoint.
• Affected Versions: Hoverfly ≤ 1.11.3
• More Info:
  • GHSA-r4h8-hfp2-ggmf
  • [NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-54123]

⚙️ Description

This vulnerability affects Hoverfly versions ≤ 1.11.3 and specifically targets the /api/v2/hoverfly/middleware endpoint. It is caused by insufficient input validation and sanitization in multiple files, including middleware.go, local_middleware.go, and hoverfly_service.go. User-controlled input provided to the script parameter is passed directly to a system binary (e.g., /bin/bash) without proper checks, allowing Remote Command Execution (RCE) with the privileges of the Hoverfly process.

• CVSS v3.1 Score: 9.8 (CRITICAL) — high impact, low attack complexity.
• Impact: An authenticated attacker can execute arbitrary commands on the underlying system, potentially leading to full system compromise.
• Mitigation: In versions ≥ 1.12.0, the affected middleware API is disabled by default. Users are strongly advised to upgrade or restrict access to the middleware endpoint.

🚀 Usage

🔧 Requirements

• curl

📥 Installation

git clone https://github.com/f4dee-backup/CVE-2025-54123

cd CVE-2025-54123

chmod +x CVE-2025-54123.sh

🧪 Help Panel

./CVE-2025-54123.sh -h

 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ███████╗      ███████╗██╗  ██╗ ██╗██████╗ ██████╗
██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗██╔════╝      ██╔════╝██║  ██║███║╚════██╗╚════██╗
██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝███████╗█████╗███████╗███████║╚██║ █████╔╝ █████╔╝
██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚════██║╚════╝╚════██║╚════██║ ██║██╔═══╝  ╚═══██╗
╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗███████║      ███████║     ██║ ██║███████╗██████╔╝
 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝╚══════╝      ╚══════╝     ╚═╝ ╚═╝╚══════╝╚═════╝
Hoverfly <= 1.11.3 - Authenticated Middleware Command Injection

[?] Parameters description:

	-t    Target base URL (e.g., http://target:8888)
	-u    Valid username
	-p    Valid password
	-c    Command to execute (must be enclosed in double quotes)
	-h    Show this help panel

[i] Example:
./CVE-2025-54123.sh -t http://target.com:8888 -u admin -p password -c "id"

⚠️ Notes

• Authentication is required to obtain a valid token.
• Multiple failed authentication attempts may trigger temporary blocking depending on internal configuration.
• Behavior may vary depending on deployment (e.g., Docker vs native).

⚠️ Disclaimer

This exploit is intended for educational and authorized security testing purposes only.

Do NOT use this against systems without explicit permission. Unauthorized access may be illegal.

The author assumes no responsibility for misuse or any damage caused.