Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation 漏洞信息(CVE-2025-54123)

一、漏洞 CVE-2025-54123 基础信息

漏洞信息

                                        # Hoverfly 中间件远程代码执行漏洞

N/A

提示

尽管我们采用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。
神龙会尽力确保数据准确，但也请结合实际情况进行甄别与判断。
神龙祝您一切顺利！

漏洞标题

Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

来源：美国国家漏洞数据库 NVD

漏洞描述信息

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 in version 1.12.0 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.

来源：美国国家漏洞数据库 NVD

CVSS信息

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

来源：美国国家漏洞数据库 NVD

漏洞类别

输入验证不恰当

来源：美国国家漏洞数据库 NVD

漏洞标题

Hoverfly 安全漏洞

来源：中国国家信息安全漏洞库 CNNVD

漏洞描述信息

Hoverfly是SpectoLabs开源的一种轻量级的开源 API 模拟工具。 Hoverfly 1.11.3及之前版本存在安全漏洞，该漏洞源于命令注入，可能导致远程代码执行。

来源：中国国家信息安全漏洞库 CNNVD

CVSS信息

N/A

来源：中国国家信息安全漏洞库 CNNVD

漏洞类别

其他

来源：中国国家信息安全漏洞库 CNNVD

二、漏洞 CVE-2025-54123 的公开POC

#	POC 描述	源链接	神龙链接
1	Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54123.yaml	POC详情

三、漏洞 CVE-2025-54123 的情报信息

标题： remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation · Advisory · SpectoLabs/hoverfly · GitHub -- 🔗来源链接

标签： x_refsource_CONFIRM
神龙速读
标题： hoverfly/core/hoverfly_service.go at master · SpectoLabs/hoverfly · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： hoverfly/core/middleware/middleware.go at master · SpectoLabs/hoverfly · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： Disabled set middleware api by default · SpectoLabs/hoverfly@17e60a9 · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： Update docs around security implication for exposing set middleware API · SpectoLabs/hoverfly@a9d4da7 · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
标题： hoverfly/core/middleware/local_middleware.go at master · SpectoLabs/hoverfly · GitHub -- 🔗来源链接

标签： x_refsource_MISC
神龙速读
https://nvd.nist.gov/vuln/detail/CVE-2025-54123