CVE-2025-54123 PoC — Hoverfly 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54123.yaml

Associated Vulnerability

Title:Hoverfly 安全漏洞 (CVE-2025-54123)
Description:Hoverfly是SpectoLabs开源的一种轻量级的开源 API 模拟工具。 Hoverfly 1.11.3及之前版本存在安全漏洞，该漏洞源于命令注入，可能导致远程代码执行。

Description

Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.

File Snapshot


 id: CVE-2025-54123

info:
  name: Hoverfly <= 1.11.3 - Remote Code Execution
  author: nukunga[seong

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.