CVE-2025-54123

Overview

Authenticated Remote Code Execution in HoverFly's middleware API endpoint due to insufficient input validation and unsafe command execution.

Attack Flow

1. Authentication

   • Attacker authenticates to HoverFly using valid credentials or session token
   • Obtains Bearer token via /api/token-auth endpoint

2. Malicious Payload Crafting

   • Attacker constructs JSON payload with:
     • binary: /bin/bash (user-controlled)
     • script: Arbitrary shell command (e.g., whoami, reverse shell)

3. Exploit Delivery

   • Sends PUT request to /api/v2/hoverfly/middleware with malicious payload
   • Includes Bearer token in Authorization header

4. Vulnerable Processing