CVE-2024-45388

Path traversal vulnerability allows file reading on Hoverfly server.

• CVSS 7.5
• CWE-22
• Input Validation and Sanitization
• Remote

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, "/")`). This issue is also tracked as GHSL-2023-274.

CVE

CVE-2024-45388

CWE

CWE-22

CVSS base score

7.5

Published

2024-09-02

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Hoverfly

Solution

Implement strict path validation to ensure that user-specified file paths do not allow directory traversal. Upgrade to the latest version of Hoverfly where this issue is patched.

import os

def read_file(filename):
    """Read file - VULNERABLE to path traversal"""
    try:
        # VULNERABILITY: No path validation
        # Attacker can use ../../../etc/passwd
        with open(filename, 'r') as f:
            return f.read()
    except Exception as e:
        return f"Error: {e}"

# Example exploitation:
# read_file("../../../etc/passwd")

import os
from pathlib import Path

def read_file_secure(filename):
    """Securely read file with path validation"""
    try:
        # Input validation
        if not filename or '..' in filename:
            return "Error: Invalid filename"
        
        # Restrict to safe directory
        safe_dir = Path("/safe_files")
        file_path = (safe_dir / filename).resolve()
        
        # Ensure path is within safe directory
        if not str(file_path).startswith(str(safe_dir)):
            return "Error: Path traversal detected"
        
        with open(file_path, 'r') as f:
            return f.read()
    except Exception:
        return "Error: Access denied"

../../../../etc/passwd

@misc{vaitp:cve202445388,
  title        = {{Path traversal vulnerability allows file reading on Hoverfly server.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-45388},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-45388/}}
}