Exploit for OS Command Injection in Hoverfly

githubexploit · 2026-03-31

Description

Overview of an OS command injection exploit for Hoverfly CVE-2025-54123 with a sample usage.

Entry point

Parameterbinary · path

Pathapi/v2/hoverfly/middleware

Authenticated middleware API vulnerability enabling OS command injection via user-controlled binary/script parameters

Affected Hoverfly versions

Hoverfly< 1.12.0

All known vulnerabilities by product

CVSS 9.8 for CVE-2025-54123

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

98%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

10.5%higher than 95.2% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2026-03-31 07:41

Last Seen:2026-03-31 07:44

Reporter:davidzzo23

Written in:Python

Last commit:2026-03-31

Tags

hoverflyCVE-2025-54123command injectionexploitusage

Other exploits for CVE-2025-54123

CVE-2025-54123-Poc

2026-09-09 KitPloitKITPLOIT

Hoverfly-1.11.3-RCE-CVE-2025-54123-Exploit

2026-09-07 KitPloitKITPLOIT

2026-09-06 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

2026-09-02 KitPloitKITPLOIT

Exploit for Improper Input Validation in Hoverfly

2026-06-18 0xk4rth1GITHUB

Exploit for Improper Input Validation in Hoverfly

2026-05-27 0x00phantom-hatGITHUB

Exploit Code

README12 lines

## https://sploitus.com/exploit?id=D31F54D0-8A5F-5D4A-B892-2829138E62EB
# CVE-2025-54123
Hoverfly CVE RCE

## Usage

```bash
python3 CVE-2025-54123.py -u $USER -p $PASS -t "http://example.com:8888" -c whoami
```

## Disclaimer
This script is intended for educational purposes only. Unauthorized use of this exploit on systems without permission is illegal. The author is not responsible for any misuse or damages caused by this exploit.