Overview
The Hoverfly API simulation tool, an open-source software widely used for API testing and simulation, has been identified with a major vulnerability, identified as CVE-2025-54123. This vulnerability affects all versions of Hoverfly up to and including 1.11.3, and allows attackers to perform remote code execution on systems running the vulnerable service. This flaw is significant as it can potentially lead to a system compromise or data leakage, hence representing a considerable risk to companies using Hoverfly in their workflows.
Vulnerability Summary
CVE ID: CVE-2025-54123
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Remote Code Execution, Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Hoverfly | 1.11.3 and prior
How the Exploit Works
The vulnerability in question is due to a combination of three distinct code-level flaws in Hoverfly. First, the program permits Insufficient Input Validation in middleware.go line 94-96. Secondly, there’s Unsafe Command Execution in local_middleware.go line 14-19. Lastly, Immediate Execution During Testing is observed in hoverfly_service.go line 173.
These flaws collectively result in a command injection vulnerability at the `/api/v2/hoverfly/middleware` endpoint. As a result, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process.
Conceptual Example Code
Given the nature of the vulnerability, an attacker could exploit it by injecting malicious code in the JSON payload. A conceptual example might look something like this:
POST /api/v2/hoverfly/middleware HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "middleware": "; rm -rf /; # " }In this example, the attacker is attempting to delete all files on the server by exploiting the command injection vulnerability. The attacker is passing a command (`rm -rf /`) as part of the `middleware` JSON value which then gets executed on the server due to insufficient validation and sanitization of user input.
How to Mitigate
Users of the Hoverfly API simulation tool are urged to upgrade to version 1.12.0 or later, which includes a patch for this vulnerability. As an added layer of security, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could help monitor and block attempted exploits.
