Giangdurian/CVE-2026-21858-and-CVE-2025-68613

# Ni8mare: n8n 未授权 RCE (CVE-2026-21858 & CVE-2025-68613) — 漏洞实验室与 PoC 报告 **Ni8mare** 漏洞链的漏洞实验室 (Vulnerable Lab) 与详细利用分析报告 —— 基于 **n8n** 平台，从 **Arbitrary File Read** (CVE-2026-21858) 到 **Remote Code Execution** (CVE-2025-68613)，无需授权认证。 ## 详细分析与利用报告 欢迎查看包含分步 PoC 图片的完整分析文档，请访问官方报告： ### [查看详细利用报告 (REPORT.md)](./REPORT.md) *(报告包含：n8n 架构分析、Content-Type Confusion 原理、Expression Injection sandbox escape、从 file read 到 RCE 的利用链、debug trace source code、root cause analysis 以及修复建议)。* ## 漏洞信息 | 属性 | 详情 | |:---|:---| | **CVE ID** | CVE-2026-21858 (File Read) + CVE-2025-68613 (RCE) | | **名称** | Ni8mare | | **漏洞类型** | Content-Type Confusion (Arbitrary File Read) + Expression Injection (Sandbox Escape → RCE) | | **严重程度** | Critical — CVSS 10.0 + 9.9 | | **受影响产品** | n8n < 1.121.0 (file read) / 0.211.0 – < 1.120.4 (RCE) | | **认证要求** | 无需认证 (pre-auth full chain) | ## 攻击链 (Attack Chain) ``` Content-Type Confusion Forge Admin JWT Expression Injection (CVE-2026-21858) (CVE-2025-68613) POST application/json --> Đọc config + DB --> Tạo workflow với filepath: /etc/passwd Tính jwt_secret malicious expression Ký admin token this.process.mainModule .require("child_process") Arbitrary File Read --> Auth Bypass --> Remote Code Execution (CVSS 10.0) (CVSS 9.9) ``` ## 实验室启动指南 (Docker) ### 前置条件 - 系统需已安装 Docker 及 Docker Compose。 ### 1. 启动环境 ``` cd ni8mare-lab docker compose up -d --build ``` ### 2. 检查状态 ``` docker compose logs -f ``` 当看到 **"Ni8mare Lab -- READY!"** 横幅并显示 version 1.65.0 时，说明实验室已准备就绪。可通过 `http://localhost:5678/` 访问 n8n。 - **管理员账号**: `admin@exploit.local` / `ExploitLab123!` - **Workflow**: "Vulnerable Form" (已 active) ### 3. 清理环境 ``` docker compose down -v ``` ## 仓库结构 ``` ├── REPORT.md # Báo cáo phân tích kỹ thuật & PoC chi tiết ├── ni8mare-lab/ # Môi trường Docker lab │ ├── docker-compose.yml # Cấu hình Docker n8n 1.65.0 │ ├── Dockerfile # Custom image với setup script │ └── init/setup.sh # Script tạo admin + workflow vulnerable ├── ni8mare_exploit.py # Exploit script — target Docker Linux (lab) ├── ni8mare_exploit_2.py # Exploit script — target Windows (n8n build từ source, dùng để debug) └── img/ # Hình ảnh minh chứng PoC ├── setup-*.png # Screenshots thiết lập lab ├── condition-*.png # Screenshots điều kiện khai thác ├── recon-*.png # Screenshots reconnaissance ├── exploit-*.png # Screenshots exploitation └── debug-*.png # Screenshots debug source code ``` ## 参考 - [GHSA-v4pr-fm98-w9pg](https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg) — Advisory CVE-2026-21858 (File Read) - [GHSA-v98v-ff95-f3cp](https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp) — Advisory CVE-2025-68613 (RCE) - [NVD — CVE-2026-21858](https://nvd.nist.gov/vuln/detail/CVE-2026-21858) - [NVD — CVE-2025-68613](https://nvd.nist.gov/vuln/detail/CVE-2025-68613)

标签：GNU通用公共许可证, n8n, Node.js, RCE, StruQ, 安全漏洞复现, 版权保护, 网络安全审计, 请求拦截, 逆向工具