Description
Hoverfly是一款面向开发人员和测试人员的轻量级服务虚拟化/ API模拟/API模拟工具。Hoverfly的/api/v2/simulation接口存在任意文件读取漏洞，攻击者可以通过使用`../`段来逃离基本路径，从而访问任何任意文件。
Hoverfly 任意文件读取漏洞(CVE-2024-45388)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/Hoverfly/Hoverfly%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3simulation%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0(CVE-2024-45388).md
https://www.cnblogs.com/hetianlab/p/18461705
https://blog.csdn.net/2401_88755455/article/details/144935962
https://www.ddpoc.com/DVB-2024-8155.html
https://zone.huoxian.cn/d/2941-hoverfly-apiv2simulation-cve-2024-45388
https://avd.aliyun.com/detail?id=AVD-2024-45388
https://cve.imfht.com/detail/CVE-2024-45388
https://blog.nsfocus.net/2024122320241229/
https://nvd.nist.gov/vuln/detail/cve-2024-45388
https://pentest-tools.com/vulnerabilities-exploits/hoverfly-1103-arbitrary-file-read_23110
https://s4e.io/tools/hoverfly-arbitrary-file-read-cve-2024-45388
https://securitylab.github.com/advisories/GHSL-2023-272_GHSL-2023-274_Hoverfly/
https://advisories.gitlab.com/golang/github.com/spectolabs/hoverfly/CVE-2024-45388/
https://cvefeed.io/vuln/detail/CVE-2024-45388
https://vulert.com/vuln-db/go-github-com-spectolabs-hoverfly-150185