Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/spectolabs/hoverfly

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7GoPublished

    Hoverfly allows an arbitrary file read in the /api/v2/simulation endpoint (GHSL-2023-274)

    CVE-2024-45388 · GHSA-6xx4-x46f-f897

    Affected
    • Go github.com/spectolabs/hoverfly < 1.10.3
    Fixed in
    1.10.3· Vendor fix available
    Issue
    Details The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the hf.Cfg.ResponsesBodyFilesPath base path by using ../ segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Proof of Concept Send the following POST request to read the /etc/passwd file: Response will contain the Hoverfly's server /etc/passwd Impact This issue may lead to Information Disclosure. Remediation The code is preventing absolute paths from being read. Make sure the final path (filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)) is contained within the expected base path (filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/"))

    Recommended action: Upgrade to 1.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →