CVE-2024-45388 PoC — Hoverfly 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-45388.yaml

Associated Vulnerability

Title:Hoverfly 安全漏洞 (CVE-2024-45388)
Description:Hoverfly是SpectoLabs开源的一种轻量级的开源 API 模拟工具。 Hoverfly v1.10.3之前版本存在安全漏洞。攻击者利用该漏洞可以从服务器读取任意文件。

Description

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server.

File Snapshot


 id: CVE-2024-45388

info:
  name: Hoverfly < 1.10.3 - Arbitrary File Read
  author: iamnoooob,rootxh

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.