n8n CVE-2025-68613 Writeup

Overview

Learn how adversaries can exploit the CVE-2025-68613 vulnerability in n8n. This critical Remote Code Execution (RCE) vulnerability affects n8n versions 0.211.0 through 1.120.3, allowing authenticated attackers to execute system-level commands with the privileges of the n8n process.

1. Introduction

In this room, we will examine CVE-2025-68613, a critical vulnerability in n8n that was published on December 19, 2025, with a CVSS score of 9.9.

n8n is an open-source workflow automation platform designed to visually connect applications and services for task automation. Users build workflows composed of nodes, with each node representing an action such as making an API request, processing data, or sending an email. n8n is frequently used to automate repetitive operational tasks and to integrate security tools and SaaS platforms.

The n8n platform is commonly deployed in three primary configurations:

• Self-hosted instances: Organizations deploy n8n on-premises or in private cloud environments for full control and data sovereignty
• Cloud-hosted (n8n.cloud): Managed service offering with shared infrastructure
• Internal automation tools: Deployed within corporate networks to automate business processes between internal and external systems

Versions 0.211.0 through 1.120.3 contain a critical Remote Code Execution (RCE) vulnerability within the workflow expression evaluation system. If exploited, this flaw enables an authenticated attacker to execute system-level commands, potentially leading to data breaches, service disruptions, or full system compromise, all with the privileges assigned to the n8n process.

In this room, we will discuss the technical aspects of this vulnerability, demonstrate exploitation via web browser, and explore detection strategies.

This vulnerability has been addressed in versions 1.120.4, 1.121.1, and 1.122.0. To ensure system security, it is essential to update to one of these patched versions.

2. Technical Background

Before exploring the exploit, let's review n8n. It is built on Node.js, using JavaScript for platform internals and user workflow logic. Its architecture includes:

• Workflow Execution Engine: The core computational component responsible for orchestrating node-based workflow execution
• Expression Evaluation System: Processes dynamic expressions wrapped in double curly braces {{ }} that are evaluated as JavaScript code during workflow execution
• Code Nodes: Allow users to write custom JavaScript or Python code as workflow steps, extending platform capabilities
• 400+ Native Integrations: Pre-built connectors to various APIs and services that form the nodes in workflows

The vulnerability resides in n8n's workflow expression evaluation system, where expressions supplied by authenticated users during workflow configuration are evaluated in an insecure execution context. The core security flaw is an expression injection vulnerability that enables authenticated attackers to execute arbitrary JavaScript code with the privileges of the n8n process. Specifically:

• n8n processes user input wrapped in double curly braces {{ }} as JavaScript code without adequate sandboxing or input validation.
• The expression evaluator lacks proper context isolation, allowing attackers to escape the intended evaluation sandbox.
• Authentication provides no meaningful protection against this vulnerability, as any authenticated user can exploit it.

The exploit uses a complex payload structure with nested function calls and the child_process module to execute system commands.

3. Exploitation

To exploit this vulnerability, we use the workflow expression evaluation system to inject malicious JavaScript code. The attack involves creating a new workflow with a Manual Trigger and an Edit Fields node containing the exploit payload.

Exploit Steps:

1. Access the vulnerable n8n instance at http://MACHINE_IP:5678
2. Log in with provided credentials
3. Create a new workflow from scratch
4. Add a Manual Trigger node
5. Add an Edit Fields (Set) node
6. Insert the exploit payload in a field value
7. Execute the workflow to run system commands

Sample Payload Structure:

{{(function(){return this.process.mainModule.require('child_process').execSync('id').toString()})()}}

This payload:

• Creates an immediately invoked function expression (IIFE)
• Accesses the Node.js process object
• Requires the child_process module
• Executes system commands using execSync
• Returns the command output as a string

Flag Capture:

By replacing the 'id' command with other system commands, we can:

• List directory contents with ls
• Read files with cat flag.txt
• Execute any system command with n8n process privileges

4. Detection

Detecting CVE-2025-68613 exploitation requires monitoring for suspicious patterns in n8n usage and system activity.

Web Request Monitoring:

Since n8n doesn't provide detailed logging for workflow execution, the most effective detection method is to monitor HTTP requests to the n8n application. Set up a proxy (like nginx) to log request bodies and look for suspicious patterns.

Sample nginx Configuration:

http {
    log_format detailed '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $body_bytes_sent '
                       '"$http_referer" "$http_user_agent" '
                       'Request-Body: "$request_body" '
                       'Content-Type: "$http_content_type" '
                       'Duration: $request_time s';
}
            

Sigma Rule for Detection:

Use Sigma rules to detect exploitation patterns in proxy logs:

• Monitor POST requests to /rest/workflows endpoint
• Search for suspicious keywords like child_process, execSync, process.mainModule.require
• Look for nested function calls and JavaScript execution patterns

Process Monitoring:

After exploitation, monitor for:

• Unexpected process creation events
• Reverse shell establishment
• Malicious payload downloads
• Reconnaissance command execution

Correlate web request detection with process creation monitoring to increase detection confidence and identify post-exploitation activities.

Mitigation

Immediate Actions:

• Update n8n: Upgrade to version 1.120.4, 1.121.1, or 1.122.0
• Access Control: Limit n8n access to trusted users only
• Network Segmentation: Isolate n8n instances from critical systems
• Monitoring: Implement comprehensive logging and alerting

Long-term Security:

• Input Validation: Implement proper sandboxing for expression evaluation
• Least Privilege: Run n8n processes with minimal required permissions
• Regular Audits: Review workflows for suspicious expressions
• Security Testing: Regular vulnerability assessments and penetration testing

Key Technical Details

• Vulnerable Component: Workflow expression evaluation system
• Attack Vector: Authenticated expression injection
• Impact: Remote Code Execution as n8n process user
• CVSS Score: 9.9 (Critical)
• Affected Versions: 0.211.0 - 1.120.3
• Fix Versions: 1.120.4, 1.121.1, 1.122.0

Lessons Learned

• Expression evaluation systems need proper sandboxing and input validation
• Authentication alone is insufficient protection against injection attacks
• JavaScript code execution contexts must be properly isolated
• Workflow automation platforms are attractive targets for attackers
• Monitoring and detection capabilities are crucial for timely response
• Regular security updates and patch management are essential
• Defense in depth should include network segmentation and access controls

Useful Commands

# Check n8n version
n8n --version

# List running workflows
n8n list:workflows

# Export workflows for analysis
n8n export:workflows

# Monitor n8n processes
ps aux | grep n8n

# Check n8n logs
journalctl -u n8n

# Test expression evaluation (safely)
node -e "console.log(eval('1+1'))"