nehkark/CVE-2025-68613

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner that detects vulnerable n8n instances by extracting the version from /signin metadata and checking it against known vulnerable ranges. It also includes a safe PoC that queries /rest/settings to confirm metadata exposure, which is presented as a correlation with weakened isolation, but does not perform or demonstrate remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python script that perform version fingerprinting and a metadata exposure check against n8n instances. The script makes only HTTP GET requests to /signin and /rest/settings, parses responses, and prints results. No backdoor, concealed executable behavior, or operator-directed harm is present. The code is transparent and limited to the described safe PoC functionality.

ClassificationScanner
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwaren8n
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is detection and validation. It extracts the n8n version, checks it against vulnerable ranges, and queries an unauthenticated endpoint to confirm metadata exposure. The README explicitly states it does not provide exploitation and the code contains no RCE payload or exploitation logic. This matches the definition of a scanner.

README.md:18-24README.md:44-65cve-2025-68613.py:4-8cve-2025-68613.py:139-191

Requirements

  • Network access to the target n8n instance's /signin and /rest/settings endpoints.cve-2025-68613.py:52-87cve-2025-68613.py:106-114

Observed behavior

  • Fetches the /signin page and extracts the n8n version from a Base64-encoded meta tag.cve-2025-68613.py:52-87
  • Compares the extracted version against known vulnerable ranges (0.211.0 to <1.120.4 and 1.121.0 to <1.121.1).cve-2025-68613.py:93-100
  • If the version is vulnerable, optionally queries /rest/settings to retrieve and display internal configuration metadata without authentication.cve-2025-68613.py:106-131
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
GET /signinUsed to extract n8n version from Base64-encoded metadata in the page.cve-2025-68613.py:54-60
Network Request
GET /rest/settingsUsed to retrieve internal configuration metadata as part of the safe PoC.cve-2025-68613.py:108-114
Author Contact
krakhen@gmail.com, @nehkark, https://vciso.cloud, ICQ 24298753Contact information provided in the README; not indicative of backdoor behavior.README.md:248-252
Review boundaries

What the analysis did not establish

  • Two files (total 4) are reported as omitted from the text content; their content is unknown.
  • The artifact's safe PoC only demonstrates unauthenticated metadata exposure, not the actual RCE vector described in the CVE.
  • Two files in the repository were classified as binary/unclassified and were not analyzed (metadata only). Their content is unknown, but the analysis scope reports 0 binary files uninspected and complete coverage for readable selected text.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1