Horizon Alert
Summary of the vulnerability and why it matters
A critical security issue exists in the n8n workflow automation platform that could allow an authenticated user to execute arbitrary code. The vulnerability stems from how the platform handles XML data, enabling a specific type of attack that, when combined with other features, compromises the server. This is serious because it allows unauthorized code execution on the n8n host.
- Remote code execution
- Requires authenticated access
- Affects n8n workflow automation
Attack Path
How an attacker could exploit the issue
An authenticated user with workflow creation rights can trigger remote code execution by sending a specially crafted XML payload to the webhook handler. This payload exploits a prototype pollution vulnerability in the xml2js library, which can then be chained with the Git node's SSH functionality to compromise the n8n host.
- Requires authenticated user access.
- Targets webhook handler and Git node.
- XML payload is the key.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could be weaponized by an attacker who has already gained authenticated access to the n8n platform with permissions to manage workflows. The attacker could then craft a malicious XML payload to trigger prototype pollution and chain it with Git node operations to achieve remote code execution.
- Requires authenticated user access.
- Exploit chained with Git node operations.
- Vulnerability patched in recent versions.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams should prioritize patching n8n to the latest versions to address the prototype pollution vulnerability. If immediate patching is not feasible, isolate affected n8n instances or restrict access to workflow management functions to prevent exploitation.
- Upgrade n8n to 1.123.32, 2.17.4, or 2.18.1.
- Isolate vulnerable n8n instances if patching is delayed.
- Monitor for unauthorized workflow modifications.
