CVE-2025-54123

Overview

Authenticated Remote Code Execution in HoverFly's middleware API endpoint due to insufficient input validation and unsafe command execution.

Attack Flow

1. Authentication

   • Attacker authenticates to HoverFly using valid credentials or session token
   • Obtains Bearer token via /api/token-auth endpoint

2. Malicious Payload Crafting

   • Attacker constructs JSON payload with:
     • binary: /bin/bash (user-controlled)
     • script: Arbitrary shell command (e.g., whoami, reverse shell)

3. Exploit Delivery

   • Sends PUT request to /api/v2/hoverfly/middleware with malicious payload
   • Includes Bearer token in Authorization header

4. Vulnerable Processing

   • HoverFly receives request and extracts binary and script parameters
   • No input validation occurs on the binary parameter
   • Creates temporary script file with user-supplied script content
   • Immediately executes: exec.Command(binary, scriptFile) during middleware validation

5. Code Execution

   • Command executes with HoverFly process privileges
   • Output returned in error response (422 status code)
   • Attacker can execute arbitrary commands or establish reverse shell

Root Causes

• Line 94-96 (middleware.go): Binary parameter accepted without validation
• Line 14-19 (local_middleware.go): User-controlled binary passed directly to exec.Command()
• Line 173 (hoverfly_service.go): Middleware executed immediately during testing

Details available here : https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf