Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
Date: 2025-09
Affected: go/github.com/SpectoLabs/hoverfly
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-54123
CWE: CWE-20
CWE-78
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary It has been discovered that the middleware functionality in Hoverfly is vulnerable to command injection through its `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. ### Details The vulnerability exists in the middleware management API endpoint `/api/v2/hoverfly/middleware`. This issue is born due to combination of three code level flaws: 1. Insufficient Input Validation in [middleware.go line 94-96](https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93): ``` func (this *Middleware) SetBinary(binary string) error { this.Binary = binary // No validation of binary parameter here return nil } ``` 2. Unsafe Command Execution in [local_middleware.go line 14-19](https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13): ``` var middlewareCommand *exec.Cmd if this.Script == nil { middlewareCommand = exec.Command(this.Binary) // User-controlled binary } else { middlewareCommand = exec.Command(this.Binary, this.Script.Name()) // User-controlled binary and script } ``` 3. Immediate Execution During Testing in [hoverfly_service.go line 173](https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173): ``` _, err = newMiddleware.Execute(testData) // Executes middleware immediately for testing ``` ### POC 1. Send the below HTTP PUT request to `http://localhost:8888` in order to create our malicious middleware,


Mitigations:

Architectural layers (MAESTRO):