n8n GSuiteAdmin Prototype Pollution to Remote Code Execution

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://simonkoeck.com/writeups/n8n-gsuiteadmin-prototype-pollution-rce
• Blog Title: n8n GSuiteAdmin Prototype Pollution to Remote Code Execution
• Suggested Section: Pentesting Web > Deserialization > NodeJS - proto & Prototype Pollution > Prototype Pollution to RCE

🎯 Content Summary

Overview

The post details a prototype-pollution vulnerability in n8n's GSuiteAdmin node that can be chained with the Git node to achieve remote code execution. The vulnerable User Create and User Update operations place attacker-controlled custom-field names into a normal JavaScript object without rejecting special keys such as __proto__, constructor, or prototype. By using __proto__ as the schema name, an a...

🔧 Technical Details

Finding prototype pollution in dynamic object construction: Search for attacker-controlled strings used as keys on ordinary JavaScript objects, particularly patterns such as target[userKey] ??= {} followed by target[userKey][nestedKey] = value. If userKey is __proto__, the first lookup can return Object.prototype. Because that result is not nullish, initialization is skipped, and the nested assignment becomes Object.prototype[nestedKey] = value. Also investigate constructor and prototype in nested assignments, recursive merges, and object-path utilities.

Converting prototype pollution into environment-variable injection: After gaining control of an enumerable property on Object.prototype, look for application components or libraries that create process-environment maps using plain objects such as {}. These maps...

🤖 Agent Actions

Updated:

src/pentesting-web/deserialization/nodejs-proto-prototype-pollution/prototype-pollution-to-rce.md

Added concise coverage of:

• Dynamic-key ??= prototype pollution sources.
• GIT_SSH_COMMAND environment injection through plain objects.
• Git-over-SSH RCE prerequisites.
• for...in/TypeORM denial-of-service effects.
• Technical mitigations and numbered references.

Validation passed: diff checks, citations, code fences, forbidden-source exclusion, and single-file scope. Full mdBook build was skipped because mdbook is unavailable.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://simonkoeck.com/writeups/n8n-gsuiteadmin-prototype-pollution-rce

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > Deserialization > NodeJS - proto & Prototype Pollution > Prototype Pollution to RCE".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0