automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -112863,6 +112863,66 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_multi/http/n8n_workflow_expression_rce": {
+    "name": "n8n Workflow Expression Remote Code Execution",
+    "fullname": "exploit/multi/http/n8n_workflow_expression_rce",
+    "aliases": [],
+    "rank": 600,
+    "disclosure_date": "2025-06-10",
+    "type": "exploit",
+    "author": [
+      "Lukas Johannes Möller"
+    ],
+    "description": "This module exploits a critical remote code execution vulnerability (CVE-2025-68613)\n          in the n8n workflow automation platform. The vulnerability exists in the workflow\n          expression evaluation system where user-supplied expressions enclosed in {{ }}\n          are evaluated in an execution context that is not sufficiently isolated from the\n          underlying Node.js runtime.\n\n          An authenticated attacker can create a workflow containing malicious expressions\n          that access the Node.js process object via this.process.mainModule.require (or via\n          the constructor) to load child_process and execute arbitrary system commands.\n          This module uses a Schedule Trigger node to automatically fire and evaluate the\n          malicious payload. This requires valid credentials to create workflows.\n\n          Successful exploitation may lead to full compromise of the n8n instance,\n          including unauthorized access to sensitive data, modification of workflows,\n          and execution of system-level operations.\n\n          Affected versions: >= 0.211.0 and < 1.120.4, < 1.121.1, < 1.122.0",
+    "references": [
+      "CVE-2025-68613",
+      "URL-https://github.com/n8n-io/n8n/security/advisories",
+      "URL-https://nvd.nist.gov/vuln/detail/CVE-2025-68613"
+    ],
+    "platform": "Linux,Unix,Windows",
+    "arch": "cmd",
+    "rport": 5678,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Unix/Linux Command",
+      "Windows Command"
+    ],
+    "mod_time": "2026-01-13 16:31:01 +0000",
+    "path": "/modules/exploits/multi/http/n8n_workflow_expression_rce.rb",
+    "is_install_path": true,
+    "ref_name": "multi/http/n8n_workflow_expression_rce",
+    "check": true,
+    "post_auth": true,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "artifacts-on-disk"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_multi/http/nas4free_php_exec": {
     "name": "NAS4Free Arbitrary Remote Code Execution",
     "fullname": "exploit/multi/http/nas4free_php_exec",