PT-2024-31591 · Hoverfly · Hoverfly

Pwntester · Published 2024-09-02 · Updated 2024-11-27 · CVE-2024-45388

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hoverfly (affected versions not specified)

Description The /api/v2/simulation POST handler in Hoverfly allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Although the code prevents absolute paths from being specified, an attacker can escape out of the hf.Cfg.ResponsesBodyFilesPath base path by using ../ segments and reach any arbitrary files. This issue may lead to Information Disclosure.

Recommendations As a temporary workaround, consider restricting access to the /api/v2/simulation endpoint until a patch is available. Make sure the final path (filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)) is contained within the expected base path (filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/")). At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2024-45388

GHSA-6XX4-X46F-F897

GO-2024-3108

Affected Products

Hoverfly

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45388.json · Exploit
• 🔥 https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45388 · Security Note
• https://osv.dev/vulnerability/GHSA-6xx4-x46f-f897 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3108 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45388 · Vendor Advisory
• https://github.com/SpectoLabs/hoverfly · Note
• https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87 · Note
• https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3 · Note
• https://t.me/cvenotify/95270 · Telegram Post
• https://t.me/cvenotify/93011 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1830712229810860040 · Twitter Post
• https://twitter.com/cracbot/status/1830848289190879434 · Twitter Post
• https://codeql.github.com/codeql-query-help/go/go-path-injection · Note
• https://twitter.com/GHSecurityLab/status/1861567867604418693 · Twitter Post