Description
Hoverfly是SpectoLabs开源的一种轻量级的开源 API 模拟工具。 Hoverfly v1.10.3之前版本存在安全漏洞。攻击者利用该漏洞可以从服务器读取任意文件。
Hoverfly /api/v2/simulation 任意文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-45388
https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897
https://www.cnblogs.com/hetianlab/p/18461705
https://zone.huoxian.cn/d/2941-hoverfly-apiv2simulation-cve-2024-45388
https://avd.aliyun.com/detail?id=AVD-2024-45388
https://blog.csdn.net/2401_88755455/article/details/144935962
https://cn-sec.com/archives/3145642.html