Description

CVE-2024-45388 affects Hoverfly, a service virtualization tool. It allows attackers to read arbitrary files from the Hoverfly server by abusing the /api/v2/simulation POST handler. Despite the code's attempt to prevent absolute paths, attackers can escape the base path using ../ segments. The SVRS of 38 indicates a moderate risk, but the vulnerability is actively exploited in the wild, making it critical to address.

Key Insights

• Uncontrolled File Access: Attackers can access sensitive files on the Hoverfly server, potentially compromising confidential data or disrupting operations.
• Exploitation in the Wild: Active exploits are available, increasing the likelihood of successful attacks.
• Moderate Severity: While the CVSS score of 7.5 suggests a moderate severity, the SVRS of 38 and the active exploitation in the wild warrant immediate attention.

Mitigation Strategies

• Update Hoverfly: Install the latest version of Hoverfly, which includes a fix for this vulnerability.
• Restrict File Access: Configure Hoverfly to restrict access to sensitive files and directories.
• Monitor for Suspicious Activity: Implement security monitoring tools to detect and respond to suspicious file access attempts.
• Educate Users: Inform users about the vulnerability and the importance of following best practices for file handling.

Additional Information

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• Exploit Status: Active exploits have been published.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.