(CVE-2025-54123) Hoverfly 中间件API命令注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-54123
• https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf
• https://github.com/davidzzo23/CVE-2025-54123
• https://www.sentinelone.com/vulnerability-database/cve-2025-54123/
• https://cvefeed.io/vuln/detail/CVE-2025-54123
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSPECTOLABSHOVERFLYCORE-12671221
• https://avd.aliyun.com/detail?id=AVD-2025-54123
• https://cn-sec.com/archives/4563163.html
• https://pentest-tools.com/vulnerabilities-exploits/hoverfly-remote-code-execution_29145
• https://github.com/f4dee-backup/CVE-2025-54123

Related Vulnerabilities

• Hoverfly /api/v2/ws/logs 信息泄露漏洞
• Hoverfly /api/v2/hoverfly/middleware 命令执行漏洞（CVE-2025-54123）
• Hoverfly 远程命令执行(CVE-2025-54123)
• PoCCVE-2024-45388: Hoverfly < 1.10.3 - Arbitrary File Read
• PoCCVE-2025-54123: Hoverfly <= 1.11.3 - Remote Code Execution
• Hoverfly 任意文件读取漏洞(CVE-2024-45388)
• Hoverfly /api/v2/simulation 任意文件读取漏洞