rxerium/CVE-2025-68613

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects vulnerable n8n instances by extracting the version from a base64-encoded meta tag on the /signin page and comparing it against known vulnerable version ranges for CVE-2025-68613.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Nuclei template (CVE-2025-68613.yaml) and a README.md file. The template performs a GET request to /signin, extracts a base64-encoded configuration value, decodes it, extracts a version string, and compares it against known vulnerable version ranges. The README provides usage instructions and contact information. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesYAML
Target softwaren8n
Attack typesCWE-913: Improper Control of Dynamically-Managed Code Resources
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs version detection and comparison to identify vulnerable instances. It does not contain any code to exploit the vulnerability, such as sending a malicious payload or executing commands. The README describes it as a 'detection method' and 'vulnerability detection script'.

CVE-2025-68613.yaml:1-62README.md:5-7README.md:47

Requirements

  • Target must be running a reachable n8n instance with the /signin endpoint accessible.CVE-2025-68613.yaml:19-21

Observed behavior

  • Sends an HTTP GET request to the /signin path of the target.CVE-2025-68613.yaml:18-21
  • Extracts a base64-encoded string from the 'n8n:config:sentry' meta tag in the response body.CVE-2025-68613.yaml:23-29
  • Decodes the base64 string and extracts the n8n version number using a regex.CVE-2025-68613.yaml:31-41
  • Compares the extracted version against known vulnerable ranges (>= 0.211.0 < 1.120.4 or >= 1.121.0 < 1.121.1) and reports the target as vulnerable if it matches.CVE-2025-68613.yaml:59-62
  • Outputs the detected n8n version string.CVE-2025-68613.yaml:43-45
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Nuclei Template
CVE-2025-68613.yamlThe template performs version detection for CVE-2025-68613 by extracting and decoding a meta tag value and comparing the version against vulnerable ranges. This is normal exploit behavior for a detection template.CVE-2025-68613.yaml:18-62
Contact Information
Signal and Twitter/X/LinkedIn links in README.mdThe README includes contact information for the author. This is not a backdoor or harmful behavior.README.md:45-49
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository were included. One file was omitted from the packet (files_total: 3, file_metadata_included: 2, file_metadata_omitted: 1). The content of the omitted file is unknown.
  • The analysis is based solely on the provided text files; no code was executed, and the behavior described is inferred from the template logic.
  • One file (LICENSE) was present in the repository but not included in the text evidence; its content is standard metadata and unlikely to contain a backdoor.
  • The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1