CVE-2025-54123: Hoverfly Command Injection RCE Vulnerability

CVE-2025-54123 Overview

CVE-2025-54123 is a critical command injection vulnerability affecting Hoverfly, an open source API simulation tool. The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware where insufficient input validation and sanitization allows attackers to inject and execute arbitrary system commands. This flaw enables unauthenticated remote code execution (RCE) on any system running vulnerable Hoverfly versions 1.11.3 and prior.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on affected Hoverfly instances, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Hoverfly versions 1.11.3 and prior
• All Hoverfly deployments with the middleware API endpoint exposed
• Systems running Hoverfly with default configurations

Discovery Timeline

• September 10, 2025 - CVE-2025-54123 published to NVD
• September 17, 2025 - Last updated in NVD database

Technical Details for CVE-2025-54123

Vulnerability Analysis

This command injection vulnerability stems from a combination of three distinct code-level flaws in the Hoverfly codebase. The vulnerability allows attackers to pass malicious input through the middleware API endpoint, which is then directly passed to system command execution without proper sanitization. Since Hoverfly executes middleware as local processes with the privileges of the Hoverfly service, successful exploitation grants attackers the ability to run arbitrary commands, upload malicious payloads, or establish reverse shells on the host server.

The attack can be executed remotely over the network without requiring authentication or user interaction, making it particularly dangerous for internet-exposed Hoverfly instances. The impact encompasses complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The vulnerability results from three interconnected code flaws:

1. Insufficient Input Validation in middleware.go (lines 94-96) - The middleware configuration accepts user input without adequate validation
2. Unsafe Command Execution in local_middleware.go (lines 14-19) - User-controlled input is passed directly to system command execution functions
3. Immediate Execution During Testing in hoverfly_service.go (line 173) - The middleware is executed immediately when set, allowing instant exploitation

Attack Vector

The attack is network-based, targeting the /api/v2/hoverfly/middleware endpoint. An attacker sends a specially crafted HTTP request to the middleware API containing malicious command injection payloads. The lack of input sanitization means shell metacharacters and command sequences are interpreted by the underlying operating system, enabling arbitrary command execution with the privileges of the Hoverfly process.

// Security patch in core/admin.go - Disabled set middleware api by default
// Source: https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40

 		&v2.HoverflyHandler{Hoverfly: hoverfly},
 		&v2.HoverflyDestinationHandler{Hoverfly: hoverfly},
 		&v2.HoverflyModeHandler{Hoverfly: hoverfly},
-		&v2.HoverflyMiddlewareHandler{Hoverfly: hoverfly},
+		&v2.HoverflyMiddlewareHandler{Hoverfly: hoverfly, Enabled: hoverfly.Cfg.EnableMiddlewareAPI},
 		&v2.HoverflyUsageHandler{Hoverfly: hoverfly},
 		&v2.HoverflyVersionHandler{Hoverfly: hoverfly},
 		&v2.HoverflyUpstreamProxyHandler{Hoverfly: hoverfly},

Detection Methods for CVE-2025-54123

Indicators of Compromise

• Unexpected HTTP PUT requests to /api/v2/hoverfly/middleware endpoint
• Suspicious process spawning from the Hoverfly process (e.g., sh, bash, cmd.exe, powershell.exe)
• Outbound network connections from Hoverfly to unusual IP addresses (potential reverse shell activity)
• Unusual file system modifications or new files created by the Hoverfly process

Detection Strategies

• Monitor web server logs for PUT requests to /api/v2/hoverfly/middleware containing shell metacharacters (;, |, &&, $(), backticks)
• Implement network-level intrusion detection rules to flag suspicious payloads targeting Hoverfly middleware endpoints
• Deploy endpoint detection to monitor for child process creation from Hoverfly service processes
• Utilize SentinelOne's behavioral AI to detect anomalous command execution patterns originating from API simulation tools

Monitoring Recommendations

• Enable verbose logging for the Hoverfly admin API and forward logs to a SIEM for correlation analysis
• Configure alerting for any successful middleware configuration changes via the API
• Monitor system call activity from the Hoverfly process for execution of shell interpreters or system utilities
• Implement network segmentation to restrict access to the Hoverfly admin API from untrusted networks

How to Mitigate CVE-2025-54123

Immediate Actions Required

• Upgrade Hoverfly to version 1.12.0 or later, which disables the set middleware API by default
• If immediate upgrade is not possible, restrict network access to the /api/v2/hoverfly/middleware endpoint using firewall rules or reverse proxy configurations
• Audit existing Hoverfly deployments to identify any internet-exposed instances
• Review system logs for evidence of exploitation attempts against the middleware endpoint

Patch Information

The vulnerability has been addressed in Hoverfly version 1.12.0 through commit 17e60a9bc78826deb4b782dca1c1abd3dbe60d40, which disables the set middleware API by default. Additional documentation updates were made in commit a9d4da7bd7269651f54542ab790d0c613d568d3e to inform users of the security implications of exposing the middleware API. For complete details, refer to the GitHub Security Advisory GHSA-r4h8-hfp2-ggmf.

Workarounds

• Use the new -enable-middleware-api=false flag (default in version 1.12.0) to explicitly disable the vulnerable API endpoint
• Implement network-level access controls to block external access to the Hoverfly admin API
• Deploy a web application firewall (WAF) with rules to detect and block command injection payloads
• Run Hoverfly with minimal system privileges to limit the impact of successful exploitation

# Configuration example - Starting Hoverfly with middleware API disabled (default in 1.12.0+)
hoverfly -enable-middleware-api=false

# For versions prior to 1.12.0, use network restrictions
# Example iptables rule to restrict admin API access to localhost only
iptables -A INPUT -p tcp --dport 8888 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP