{"answers":{"affected":"5 open source packages ship an affected version, including github.com/SpectoLabs/hoverfly and github.com/spectolabs/hoverfly. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45388 exists.","fix":"Upgrade github.com/SpectoLabs/hoverfly to 1.10.3 or later.","what":"CVE-2024-45388 is a high-severity path traversal vulnerability in SpectoLabs hoverfly, published on 2 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-45388 and fix it if it is affected.\n\nWhat it is: CVE-2024-45388 is a high-severity path traversal vulnerability in SpectoLabs hoverfly, published on 2 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45388 exists.\n\nAffected packages and fixed versions:\n- github.com/SpectoLabs/hoverfly (Go): affected all versions; fixed in 1.10.3\n- github.com/SpectoLabs/hoverfly (Go): affected all versions; fixed in 1.10.3\n- github.com/SpectoLabs/hoverfly (Go): affected all versions; fixed in 1.10.3\n- github.com/spectolabs/hoverfly (Go): affected all versions; fixed in 1.10.3\n- github.com/spectolabs/hoverfly (Go): affected all versions; fixed in 1.10.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-45388/ (Markdown: https://insights.sbomify.com/CVE-2024-45388/index.md)","id":"CVE-2024-45388","markdown":"https://insights.sbomify.com/CVE-2024-45388/index.md","name":"CVE-2024-45388","record":{"aliases":["GHSA-6xx4-x46f-f897","GO-2024-3108"],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"API simulation tool","requires_auth":"none","summary":"An attacker can read arbitrary files from the Hoverfly server by exploiting path traversal in the simulation API endpoint.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"hoverfly","vendor":"hoverfly"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Note that, although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue was found using the Uncontrolled data used in path expression CodeQL query for python. Users are advised to make sure the final path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, filePath)`) is contained within the expected base path (`filepath.Join(hf.Cfg.ResponsesBodyFilesPath, \"/\")`). This issue is also tracked as GHSL-2023-274.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":1,"refs":[{"date":null,"kind":"nuclei","ref":"http/cves/2024/CVE-2024-45388.yaml","stars":null,"title":"Hoverfly \u003c 1.10.3 - Arbitrary File Read"}],"tier":"weaponised"},"has_fix":true,"headline":"Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)","id":"CVE-2024-45388","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":5,"n_references":4,"next":{"headline":"Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)","id":"CVE-2024-45389"},"packages":[{"ecosystem":"Go","fixed":["1.10.3"],"introduced":["0"],"last_affected":[],"package":"github.com/SpectoLabs/hoverfly","purl":null,"source":"GHSA-6xx4-x46f-f897"},{"ecosystem":"Go","fixed":["1.10.3"],"introduced":["0"],"last_affected":[],"package":"github.com/SpectoLabs/hoverfly","purl":"pkg:golang/github.com/SpectoLabs/hoverfly","source":"GHSA-6xx4-x46f-f897"},{"ecosystem":"Go","fixed":["1.10.3"],"introduced":["0"],"last_affected":[],"package":"github.com/SpectoLabs/hoverfly","purl":"pkg:golang/github.com/SpectoLabs/hoverfly","source":"GO-2024-3108"},{"ecosystem":"Go","fixed":["1.10.3"],"introduced":["0"],"last_affected":[],"package":"github.com/spectolabs/hoverfly","purl":null,"source":"GHSA-6xx4-x46f-f897"},{"ecosystem":"Go","fixed":["1.10.3"],"introduced":["0"],"last_affected":[],"package":"github.com/spectolabs/hoverfly","purl":"pkg:golang/github.com/spectolabs/hoverfly","source":"GHSA-6xx4-x46f-f897"}],"prev":{"headline":"Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments","id":"CVE-2024-45387"},"products":["hoverfly"],"published":"2024-09-02","related":[{"cvss_score":9.8,"headline":"Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation","id":"CVE-2025-54123","kev_date_added":null,"published":"2025-09-10"},{"cvss_score":7.8,"headline":"Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.","id":"CVE-2025-54376","kev_date_added":null,"published":"2025-09-10"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"MIT","name":"Nuclei templates"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-03","vendors":["SpectoLabs"]},"summary":"An attacker can read arbitrary files from the Hoverfly server by exploiting path traversal in the simulation API endpoint.","url":"https://insights.sbomify.com/CVE-2024-45388/"}