thinQtankLABS

Detection Engineering & Incident Response: CVE-2025-68613

Respond to an n8n workflow-expression RCE compromise (CVE-2025-68613). Reconstruct the timeline from the n8n audit and execution logs, see how an expression calling require()/child_process escaped the sandbox and ran as the n8n process, find the attacker's rogue scheduled-workflow persistence, engineer a detection rule for dangerous expressions, then contain by restricting editing, eradicate, upgrade, verify and report - including rotating stored credentials.

Intermediate 21 guided steps 6 tasks About 75 minutes Runs in your browser

Skills you will practice

  • n8n audit and execution-log correlation
  • Timeline reconstruction
  • Code-injection IOCs
  • Sandbox-escape analysis
  • Scheduled-workflow persistence hunting
  • Detection engineering
  • Containment and eradication
  • Credential rotation
  • Incident reporting

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA CySA+ CS0-003 Log analysis, detection and IR Training at thinQtank Learning EC-Council Certified Incident Handler E|CIH Incident-handling lifecycle Training at thinQtank Learning EC-Council Certified Ethical Hacker CEH Code injection and IOCs Training at thinQtank Learning ISC2 CISSP CISSP Security Operations and insider threat Training at thinQtank Learning
Part of these certification lab packages: CySA+ CS0-003 CISSP Certified Ethical Hacker (CEH) CEH Certified Incident Handler (E|CIH) E|CIH GCIH GCIH GCIA GCIA

The scenario

A self-hosted n8n server (CVE-2025-68613 open) logged a workflow editor saving an expression that references require()/child_process, then the n8n process spawned a shell. You are the responder. Classify it.

What you will do

  1. Open and classify the incident4 steps

    Open the incident · Read the alert · Read the ticket · Classify it

  2. Reconstruct the timeline3 steps

    Pull the attacker’s actions · Correlate the execution log · What made RCE possible?

  3. Impact and persistence3 steps

    Inspect the rogue workflow · What persistence? · Record IOCs

  4. Engineer a detection rule4 steps

    Study the sample · Write a rule · Test and tune · Why not flag the word "process"?

  5. Contain, eradicate, verify5 steps

    Contain: restrict workflow editing · Eradicate the persistence · Upgrade n8n · Verify the host · …

  6. Report2 steps

    Write the report · What must also be rotated?

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.