Listen to this Post
The vulnerability resides in n8n’s workflow expression evaluation system, where user-supplied expressions during workflow configuration are processed. Authenticated users can inject malicious expressions that are evaluated within a JavaScript execution context lacking proper isolation from the Node.js runtime. This allows access to global objects and built-in functions. Specifically, expressions can leverage constructors like `Function` or `eval` to break out of the sandbox. Attackers can chain operations to import critical modules such as child_process, enabling arbitrary command execution. The evaluation engine does not adequately restrict access to the `require` function or `process` object. Consequently, a crafted expression can execute system commands with the privileges of the n8n process, leading to full host compromise. The issue stems from insufficient input sanitization and context separation in the expression parser.
Platform: n8n
Version: Before v1.122.0
Vulnerability: Remote Code Execution
Severity: Critical
date: Not specified
Prediction: Fixed v1.122.0
What Undercode Say:
curl -X POST http://target/n8n-endpoint
{{ $eval("require('child_process').exec('id')") }}
How Exploit:
Authenticated user injects expression.
Expression evaluates malicious code.
Commands execute on host.
Protection from this CVE
Update to v1.122.0.
Restrict workflow permissions.
Harden server environment.
Impact:
Full system compromise.
Data theft unauthorized.
Workflow manipulation possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
