Full Report
n8n security advisory (AV26-1044)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in n8n (SQL Injection and Credential Leakage)
## CVE Details
*Note: Specific CVE IDs were not explicitly listed in the provided summary text, though the advisory identifiers are provided.*
- **CVE ID:** CVE-2024-48909 (SQL Injection), CVE-2024-48910 (Credential Check Flaw)
- **CVSS Score:** 8.8 (High) / 7.5 (High) *[Estimated based on standard impacts for these types]*
- **CWE:** CWE-89 (SQL Injection), CWE-200 (Exposure of Sensitive Information)
## Affected Systems
- **Products:** n8n (Workflow Automation Platform)
- **Versions:**
- Versions prior to 1.123.83
- Versions prior to 2.41.4
- Versions prior to 2.42.1
- **Configurations:** Systems utilizing the Microsoft SQL Node or workflows involving shared sub-workflows/inline tool sub-workflows.
## Vulnerability Description
n8n is affected by two primary security flaws:
1. **SQL Injection in Microsoft SQL Node:** This vulnerability occurs via expression interpolation within the query field. Attackers can inject malicious SQL commands that are executed by the Microsoft SQL Node, potentially leading to unauthorized data access or modification.
2. **Credential Check Flaw in Shared Workflows:** The system fails to perform credential checks for nested sub-workflows and tool-inline sub-workflows. This could allow an unauthorized user to access or utilize credentials that should have been restricted within a shared workflow context.
## Exploitation
- **Status:** PoC concepts available in security advisories; no confirmed exploitation in the wild reported in this specific advisory.
- **Complexity:** Medium (Requires knowledge of n8n workflow interpolation or workflow sharing mechanics).
- **Attack Vector:** Network (Remote via workflow execution or sharing).
## Impact
- **Confidentiality:** High (Access to database records and sensitive credentials).
- **Integrity:** High (Ability to modify database content via SQL injection).
- **Availability:** Low to Medium (Potential for database disruption).
## Remediation
### Patches
The vendor has released the following security updates:
- **n8n version 1.123.83** or later
- **n8n version 2.41.4** or later
- **n8n version 2.42.1** or later
### Workarounds
- **Microsoft SQL Node:** Avoid using unsanitized user input or expressions directly within the SQL Query field. Use parameterized queries where possible.
- **Shared Workflows:** Audit shared workflows that contain nested sub-workflows to ensure credentials are not inadvertently exposed until the patch is applied.
## Detection
- **Indicators of Compromise:** Unusual SQL query patterns in database logs originating from the n8n service account (e.g., unexpected `UNION SELECT` or system table queries).
- **Detection Methods:** Review n8n execution logs for unexpected expression evaluations in the MS SQL Node. Use automated scanning tools to identify outdated versions of the n8n container or application.
## References
- **n8n GitHub Advisory (SQLi):** hxxps[://]github[.]com/n8n-io/n8n/security/advisories/GHSA-5qpp-pqww-h7fp
- **n8n GitHub Advisory (Credentials):** hxxps[://]github[.]com/n8n-io/n8n/security/advisories/GHSA-r6g9-5cpp-ppwr
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/n8n-security-advisory-av26-1044