CVE-2024-45388
📋 TL;DR
CVE-2024-45388 is a path traversal vulnerability in Hoverfly's simulation API that allows attackers to read arbitrary files from the server filesystem. This affects all Hoverfly users who expose the vulnerable API endpoint, particularly developers and testers using Hoverfly for API simulation. The vulnerability bypasses path restrictions through directory traversal sequences.
💻 Affected Systems
- Hoverfly
📦 What is this software?
Hoverfly by Hoverfly
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files, or credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive configuration files, source code, or credential files stored on the Hoverfly server.
If Mitigated
Limited impact if proper network segmentation and file system permissions restrict access to sensitive files.
🎯 Exploit Status
Exploitation requires only HTTP POST requests to the vulnerable endpoint with crafted path traversal payloads. No authentication is required if the endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.10.3
Vendor Advisory: https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897
Restart Required: Yes
Instructions:
1. Download Hoverfly v1.10.3 or later from GitHub releases. 2. Stop the running Hoverfly instance. 3. Replace the binary with the patched version. 4. Restart Hoverfly service.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Hoverfly API endpoints to trusted IP addresses only.
# Use firewall rules to restrict access
iptables -A INPUT -p tcp --dport 8500 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 8500 -j DROP
Disable Vulnerable Endpoint
allDisable or block access to the /api/v2/simulation POST endpoint if not required.
# Use reverse proxy or application firewall to block the endpoint
location /api/v2/simulation { deny all; }
🧯 If You Can't Patch
- Implement strict file system permissions to limit Hoverfly's access to sensitive files
- Deploy Hoverfly in isolated containers with minimal host filesystem access
🔍 How to Verify
Check if Vulnerable:
Check if Hoverfly version is below v1.10.3 and if the /api/v2/simulation endpoint is accessible.Check Version:
./hoverfly --versionVerify Fix Applied:
Verify Hoverfly version is v1.10.3 or later and test that path traversal attempts to the simulation endpoint are properly blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /api/v2/simulation with ../ sequences in parameters
- File access errors for unexpected paths in Hoverfly logs
Network Indicators:
- Unusual file read patterns from Hoverfly server
- Multiple failed attempts to access restricted paths
SIEM Query:
source="hoverfly.log" AND "POST /api/v2/simulation" AND (".." OR "%2e%2e")🔗 References
- https://codeql.github.com/codeql-query-help/go/go-path-injection
- https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3
- https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897
- https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87
