🚀 n8n Authenticated RCE PoC (Pocsuite3)

CVE ID: CVE-2025-68613
Type: Authenticated Remote Code Execution
Framework: Pocsuite3

This is a vulnerability verification and exploitation script based on the Pocsuite3 framework, used to detect the authenticated remote code execution (RCE) vulnerability in the n8n workflow automation tool. The script supports both harmless verification (Verify) and command execution (Attack) modes, and includes automatic cleanup of test traces.

⚙️ Parameter Description

This script extends the basic parameters of Pocsuite3 with the following custom parameters, which must be passed via --options at runtime:

🚀 Usage

Ensure pocsuite3 is installed (pip install pocsuite3), and save the script as n8n_auth_rce.py.

1. Verify Mode

In verify mode, the script sends a workflow containing a safe mathematical calculation (11111 + 22222) to the target. If the returned result is 33333, it confirms that the JS engine can be invoked maliciously. This mode is harmless and does not execute system commands.

pocsuite -r n8n_auth_rce.py -u http://target-n8n.com --verify --options '{"api_key": "YOUR_API_KEY_HERE"}'

Expected output:

[+] Vulnerable! JS Expression executed. Result: 33333

2. Attack Mode

Attack mode allows you to execute arbitrary system commands. By default, it executes the id command, but you can customize the command via the cmd parameter.

Execute default command (id):

pocsuite -r n8n_auth_rce.py -u http://target-n8n.com --attack --options '{"api_key": "YOUR_API_KEY_HERE"}'

Execute custom command (e.g., whoami):

pocsuite -r n8n_auth_rce.py -u http://target-n8n.com --attack --options '{"api_key": "YOUR_API_KEY_HERE", "cmd": "whoami"}'

Expected output:

[+] Command 'whoami' executed:
root

🧩 Script Logic Overview

The execution flow of this PoC is designed as a closed loop to minimize residual impact on the target system:

1. Construction: Construct a malicious Workflow JSON using the provided api_key, containing an n8n-nodes-base.set node.
2. Injection: Inject the payload (Node.js code require('child_process').execSync(...)) into the node's value field.
3. Deployment: Send a POST request to /rest/workflows to create a temporary workflow and obtain the workflow_id.
4. Trigger: Send a POST request to /rest/workflows/{id}/run to trigger the workflow execution and parse the returned JSON to extract command output.
5. Cleanup: Regardless of whether the exploitation succeeds, a DELETE request is sent to /rest/workflows/{id} to delete the temporary workflow, keeping the environment clean.

⚠️ Disclaimer

Please read carefully before use

1. Authorization Principle: This tool is intended for cybersecurity professionals to perform security testing or vulnerability verification on target systems with explicit authorization.
2. Illegal Activities: It is strictly prohibited to use this tool for any unauthorized penetration testing, attack behavior, or illegal purposes.
3. Liability: Any consequences (including but not limited to system damage, data loss, legal disputes) arising from the use of this tool shall be borne solely by the user. The developer and contributors assume no legal responsibility.
4. Compliance: Users must comply with local laws and regulations (e.g., the Cybersecurity Law of the People's Republic of China).