Path Traversal in Hoverfly
CVE-2024-45388
Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/")`). This issue is also tracked as GHSL-2023-274.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.556 (99.0th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.556 · newest: 0.556 · change: 0.000
Affected products
- Hoverfly
- Spectolabs Hoverfly — versions < 1.10.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897 (Exploit, Vendor Advisory)
- codeql.github.com/codeql-query-help/go/go-path-injection (Not Applicable)
- github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3 (Release Notes)
- github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/co… (Product)
Frequently asked questions
- What is CVE-2024-45388?
- CVE-2024-45388 is a high-severity vulnerability in Hoverfly, classified under Information Disclosure. CVSS score: 7.5/10. Published 2024-09-02.
- How severe is CVE-2024-45388?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-45388 known to be exploited?
- 20 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.