CVE-2025-54376
📋 TL;DR
Hoverfly versions 1.11.3 and prior have an authentication bypass vulnerability in the admin WebSocket endpoint /api/v2/ws/logs. Unauthenticated attackers can stream real-time application logs containing sensitive data like internal file paths and request/response bodies. Organizations using vulnerable Hoverfly instances are affected.
💻 Affected Systems
- Hoverfly
📦 What is this software?
Hoverfly by Hoverfly
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full visibility into application internals, extract credentials or sensitive data from logs, and use insights for further attacks.
Likely Case
Information disclosure of internal paths, API traffic details, and potentially sensitive data logged by applications.
If Mitigated
Limited impact if logs contain no sensitive data and endpoint is network-restricted.
🎯 Exploit Status
Simple WebSocket connection to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.0
Vendor Advisory: https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-jxmr-2h4q-rhxp
Restart Required: Yes
Instructions:
1. Stop Hoverfly service. 2. Update to version 1.12.0 or later. 3. Restart service.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to Hoverfly admin endpoints using firewall rules.
iptables -A INPUT -p tcp --dport 8888 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 8888 -j DROP
Disable Admin API
allRun Hoverfly without admin API if not needed.
hoverfly -disable-admin-api
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Hoverfly instances.
- Configure application logging to exclude sensitive data from Hoverfly logs.
🔍 How to Verify
Check if Vulnerable:
Attempt WebSocket connection to ws://hoverfly_host:8888/api/v2/ws/logs without authentication.Check Version:
hoverfly --versionVerify Fix Applied:
Verify WebSocket connection to /api/v2/ws/logs endpoint requires authentication after update.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated WebSocket connections to /api/v2/ws/logs endpoint
Network Indicators:
- WebSocket traffic to port 8888 from untrusted sources
SIEM Query:
source_port=8888 AND (uri_path="/api/v2/ws/logs" OR protocol="websocket")