PT-2025-37088 · Hoverfly · Hoverfly

Kr1Shna4Garwal · Published 2025-09-10 · Updated 2026-05-10 · CVE-2025-54123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Hoverfly versions 1.11.3 and prior

Description: Hoverfly is vulnerable to a command injection issue at the /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization of user input. This vulnerability stems from a combination of flaws: insufficient input validation, unsafe command execution, and immediate execution during testing. An attacker can exploit this to gain remote code execution (RCE) on systems running the vulnerable Hoverfly service, potentially executing arbitrary commands with the privileges of the Hoverfly process.

Recommendations: Update to version 1.12.0 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2025-54123

GHSA-R4H8-HFP2-GGMF

GO-2025-3944

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Affected Products

Hoverfly

References · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54123.json · Exploit
• 🔥 https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf · Exploit
• https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e · Patch
• https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40 · Patch
• https://osv.dev/vulnerability/CVE-2025-54123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54123 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3944 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15564-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4h8-hfp2-ggmf · Vendor Advisory
• https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93 · Note
• https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173 · Note
• https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13 · Note
• https://github.com/SpectoLabs/hoverfly · Note
• https://github.com/SpectoLabs/hoverfly/pull/1203 · Note