CVE-2025-54123
published 2025-09-10CVE-2025-54123: Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection…
PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
10.54%
95.2th percentile
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | spectolabs_hoverfly | 0 – 1.11.3 | — |
| hoverfly | hoverfly | < 1.12.0 | 1.12.0 |
| spectolabs | hoverfly | <= 1.11.3 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPUT /api/v2/hoverfly/middleware HTTP/1.1
Content-Type: application/json
{"binary": "/bin/sh", "script": "cat /etc/passwd"}
otherhttp.favicon.hash:1357234275
othericon_hash="1357234275"
- →Look for PUT requests to /api/v2/hoverfly/middleware with a JSON body containing 'binary' and 'script' fields; unauthenticated access to this endpoint is the attack vector.
- →A successful exploitation attempt returns HTTP 422 with 'STDOUT:' and 'hoverfly' in the response body, along with command output (e.g., root:x:0:0 from /etc/passwd).
- →Identify exposed Hoverfly instances via Shodan favicon hash 1357234275 or page title 'Hoverfly Dashboard' as potential targets.
- →The flaw involves three code-level issues: insufficient input validation in middleware.go (line 94-96), unsafe command execution in local_middleware.go (line 14-19), and immediate execution during testing in hoverfly_service.go (line 173). ↗
- ·The middleware API endpoint is only exploitable if it is exposed; version 1.12.0 disables it by default. Operators who explicitly re-enable it remain at risk. ↗
- ·Exploitation requires no authentication; any network-accessible Hoverfly instance running <= 1.11.3 is directly exploitable without credentials. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
osv·2025-09-17
CVE-2025-54123 Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly
GHSA
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
ghsa·2025-09-10
CVE-2025-54123 [CRITICAL] CWE-20 Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
### Summary
It has been discovered that the middleware functionality in Hoverfly is vulnerable to command injection through its `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input.
### Details
The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`.
This issue is born due to combination of three code level flaws:
1. Insufficient Input Validation in [middleware.go line 94-96](https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93):
```
func (this *Middleware) SetBinary(binary string) error {
this.Binary = binary // No validation of binary parameter here
return nil
}
```
2. U
OSV
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
osv·2025-09-10
CVE-2025-54123 [CRITICAL] Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
### Summary
It has been discovered that the middleware functionality in Hoverfly is vulnerable to command injection through its `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input.
### Details
The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`.
This issue is born due to combination of three code level flaws:
1. Insufficient Input Validation in [middleware.go line 94-96](https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93):
```
func (this *Middleware) SetBinary(binary string) error {
this.Binary = binary // No validation of binary parameter here
return nil
}
```
2. U
VulnCheck
hoverfly hoverfly Improper Input Validation
vulncheck·2025·CVSS 9.8
CVE-2025-54123 [CRITICAL] hoverfly hoverfly Improper Input Validation
hoverfly hoverfly Improper Input Validation
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the inp
No detection rules found.
Nuclei
Hoverfly <= 1.11.3 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2025-54123 [CRITICAL] Hoverfly <= 1.11.3 - Remote Code Execution
Hoverfly <= 1.11.3 - Remote Code Execution
Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.
Template:
id: CVE-2025-54123
info:
name: Hoverfly <= 1.11.3 - Remote Code Execution
author: nukunga[seonghyeonJeon]
severity: critical
description: |
Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary comm
No writeups or analysis indexed.
https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3ehttps://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmfhttps://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf
2025-09-10
Published
Exploited in the wild