tristanqtn/CVE-2025-54123

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that authenticates to a Hoverfly instance and exploits CVE-2025-54123 to achieve authenticated remote code execution via command injection in the middleware API endpoint.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md describing the CVE-2025-54123 vulnerability and an exploit.py script that implements a proof-of-concept for the described authenticated remote code execution. The exploit.py script performs only the expected exploit behavior: authenticating to a Hoverfly instance, sending a crafted payload to the vulnerable middleware endpoint, and executing user-supplied commands or establishing a reverse shell. No concealed executable behavior, persistence mechanisms, credential exfiltration to unrelated parties, or other backdoor functionality was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareHoverfly
Attack typescommand injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits CVE-2025-54123 by sending crafted requests to execute arbitrary commands on a vulnerable Hoverfly instance. It includes authentication, payload delivery, command execution, and output retrieval, which constitutes an exploit.

exploit.py:1-308README.md:4

Requirements

  • Valid Hoverfly credentials (username/password) or a session tokenexploit.py:38-50exploit.py:250-262
  • Target Hoverfly instance running a vulnerable version (<= 1.11.3)README.md:4

Observed behavior

  • Authenticates to the target Hoverfly instance using provided credentials or session tokenexploit.py:38-50exploit.py:53-64
  • Sends a PUT request to /api/v2/hoverfly/middleware with a JSON payload containing a user-controlled binary and scriptexploit.py:67-77exploit.py:80-94
  • Executes arbitrary shell commands on the target and returns output extracted from the error responseexploit.py:107-121
  • Provides an interactive shell and reverse shell capabilityexploit.py:129-144exploit.py:147-164
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
exploit.py sends crafted JSON payloads to /api/v2/hoverfly/middleware to achieve remote code executionThis is the normal exploit behavior for CVE-2025-54123 as described in the README and CVE record.exploit.py:67-77exploit.py:80-94
Reverse Shell Functionality
exploit.py includes a revshell mode that sends a bash reverse shell command to the targetThis is a standard feature of RCE exploits and is explicitly documented in the script's help text and the CVE description.exploit.py:147-164exploit.py:34
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and exploit.py) were provided; no other files from the repository were included in the evidence packet.
  • The analysis is limited to static review of the source code; dynamic behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1