SpectoLabs hoverfly up to 1.11.3 API Endpoint middleware input validation

Summaryinfo

A vulnerability has been found in SpectoLabs hoverfly up to 1.11.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v2/hoverfly/middleware of the component API Endpoint. The manipulation leads to input validation. This vulnerability is listed as CVE-2025-54123. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SpectoLabs hoverfly up to 1.11.3. This issue affects an unknown part of the file /api/v2/hoverfly/middleware of the component API Endpoint. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: Insufficient Input Validation in middleware.go line 94-96; Unsafe Command Execution in local_middleware.go line 14-19; and Immediate Execution During Testing in hoverfly_service.go line 173. This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the Hoverfly process. Commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 disables the set middleware API by default, and subsequent changes to documentation make users aware of the security changes of exposing the set middleware API.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-54123 since 07/17/2025. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 17e60a9bc78826deb4b782dca1c1abd3dbe60d40 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-27608). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• SpectoLabs

Name

• hoverfly

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3

Website

• Product: https://github.com/SpectoLabs/hoverfly/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion