CVE-2025-57749

Executive Summary

CVE-2025-57749 is a symlink traversal vulnerability in the n8n workflow automation platform, specifically within the Read/Write File node. This flaw allows an authenticated attacker with the ability to create symbolic links (e.g., via the Execute Command node) to bypass directory restrictions and read or write arbitrary files on the server. The vulnerability has a CVSS score of 6.5 (Medium) and affects all versions prior to 1.106.0. n8n.cloud users are not impacted. No public proof-of-concept (PoC) code or exploit is currently available, but the risk is significant due to the potential for data exfiltration and system compromise.

Supply Chain & Package Security

n8n is an npm package (n8n). The vulnerability exists in the core application logic, not in a direct dependency. However, the ability to create symlinks via the Execute Command node introduces a supply chain risk if an attacker can inject malicious commands or workflows. Users should verify the integrity of their n8n installation and ensure no unauthorized workflows are active.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with workflow creation permissions)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

The threat level is elevated due to the low attack complexity and the potential for high impact on confidentiality and integrity. An attacker can read sensitive files (e.g., configuration files, credentials) and overwrite critical system files.

Deep Dive & Mechanics

The vulnerability lies in the Read/Write File node's path validation logic. The node is designed to restrict file operations to a specific allowed directory (e.g., /data). However, it does not properly resolve symbolic links before checking the path. An attacker can create a symlink within the allowed directory that points to an arbitrary file outside the allowed directory (e.g., /etc/passwd). When the node attempts to read or write to the symlink, it follows the link and performs the operation on the target file.

Attack Scenario:

1. An authenticated attacker creates a workflow with an Execute Command node.
2. The Execute Command node runs a command like ln -s /etc/passwd /data/evil_link.
3. The attacker then uses the Read/Write File node to read /data/evil_link, which returns the contents of /etc/passwd.
4. Similarly, the attacker can write to /data/evil_link to overwrite /etc/passwd or other critical files.

The vulnerability is exacerbated by the fact that n8n workflows can be triggered automatically, allowing for persistent exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 1.106.0): The path validation likely uses a simple string prefix check or path.resolve() without checking for symlinks.

// Vulnerable example
const allowedDir = '/data';
const userPath = '/data/evil_link';
const resolvedPath = path.resolve(userPath);
if (resolvedPath.startsWith(allowedDir)) {
    // This passes because the symlink is inside /data
    fs.readFileSync(resolvedPath);
}

Patched Code (n8n >= 1.106.0): The patched version uses fs.realpathSync() to resolve symlinks before validation.

// Patched example
const allowedDir = '/data';
const userPath = '/data/evil_link';
const realPath = fs.realpathSync(userPath);
if (realPath.startsWith(allowedDir)) {
    // This fails because realPath resolves to /etc/passwd
    fs.readFileSync(realPath);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an n8n instance (version < 1.106.0) with workflow creation permissions.
• Ability to use the Execute Command node.

Exploitation Steps:

1. Create a new workflow.
2. Add an Execute Command node with the following command to create a symlink:

   ln -s /etc/passwd /data/evil_link
   

3. Add a Read/Write File node configured to read /data/evil_link.
4. Execute the workflow. The node will return the contents of /etc/passwd.
5. For writing, use the Write mode in the Read/Write File node to overwrite the target file.

Example Workflow JSON (simplified):

{
  "nodes": [
    {
      "name": "Execute Command",
      "type": "n8n-nodes-base.executeCommand",
      "parameters": {
        "command": "ln -s /etc/passwd /data/evil_link"
      }
    },
    {
      "name": "Read File",
      "type": "n8n-nodes-base.readWriteFile",
      "parameters": {
        "operation": "read",
        "filePath": "/data/evil_link"
      }
    }
  ]
}

Blue Team

Detection:

• Monitor for unexpected symlink creation within n8n data directories.
• Alert on workflows that use both Execute Command and Read/Write File nodes in sequence.
• Review file access logs for paths outside the expected allowed directory.

Hunting:

• Search for symlinks in the n8n data directory:

  find /data -type l -exec ls -la {} \;
  

• Check for workflows with suspicious commands:

  SELECT * FROM workflow WHERE nodes LIKE '%ln -s%';
  

Prevention:

• Restrict the Execute Command node to a whitelist of allowed commands.
• Use a chroot or containerized environment for n8n.
• Implement file integrity monitoring (FIM) on critical system files.

Indicators of Compromise (IOCs)

• File Paths:
  • /data/evil_link (or any symlink in the data directory)
  • /etc/passwd (if read)
  • /etc/shadow (if read)
  • /etc/ssh/sshd_config (if modified)
• Processes:
  • ln -s commands executed by n8n
  • node processes reading/writing unexpected files
• Network:
  • Outbound connections from n8n to external IPs (if data exfiltration occurs)
• Logs:
  • n8n workflow execution logs showing Read/Write File node accessing symlinks
  • System logs showing file access outside allowed directories

Detection Engineering

YARA Rule

rule CVE_2025_57749_Symlink_Traversal {
    meta:
        description = "Detects symlink creation and file read/write patterns indicative of CVE-2025-57749 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57749"
    strings:
        $symlink_cmd = "ln -s" ascii wide nocase
        $read_file = "readWriteFile" ascii wide nocase
        $execute_cmd = "executeCommand" ascii wide nocase
        $file_path = "/data/" ascii wide nocase
    condition:
        all of ($symlink_cmd, $read_file, $execute_cmd) or
        ($symlink_cmd and $file_path)
}

Sigma Rule

title: CVE-2025-57749 Symlink Traversal in n8n
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-57749 via symlink creation and file access
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-57749
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/node'
        CommandLine|contains: 'ln -s'
    condition: selection
falsepositives:
    - Legitimate use of symlinks in n8n workflows
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-57749 n8n Symlink Traversal - Potential Data Exfiltration"; flow:to_server,established; content:"/data/"; http_uri; content:"readWriteFile"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade n8n to version 1.106.0 or later.
2. If upgrade is not possible, disable the Execute Command node or restrict its usage to trusted users only.
3. Review all existing workflows for suspicious symlink creation or file access patterns.

Long-term Mitigations:

• Implement strict input validation and path canonicalization in all file-related nodes.
• Use a sandboxed environment (e.g., Docker container with read-only root filesystem) for n8n.
• Enable audit logging for file system operations.
• Regularly review and audit n8n workflows.

Workarounds:

• Use a custom script to periodically scan for symlinks in the n8n data directory and alert on new ones.
• Implement a web application firewall (WAF) rule to block requests containing ln -s or similar commands.

Valters IT
Securing Digital Frontiers