Critical Vulnerability in n8n Allows Remote File Manipulation and Data Disclosure

The BSI has released an advisory regarding a security vulnerability in n8n, a workflow automation platform. The flaw enables a remote, unauthenticated attacker to perform unauthorized file manipulation and potentially disclose sensitive information from the host environment. This vulnerability, identified as CVE-2024-51746, poses a risk to any organization utilizing n8n instances, particularly those exposed to the internet. Because n8n often integrates with various SaaS applications, databases, and internal services, successful exploitation could provide an attacker with access to highly sensitive credentials, workflow definitions, and data processed by these automations. Defenders should verify their n8n instance versions and ensure they are patched to the latest version to mitigate this risk.

Impact

Successful exploitation of this vulnerability allows an unauthorized attacker to interact with the underlying filesystem of the n8n server. This could lead to the exposure of environment variables, API keys, and configuration files, or the overwriting of files to facilitate persistent access or further code execution within the workflow environment.

Recommendation

• Identify all instances of n8n within the enterprise network and verify their version against vendor patches for CVE-2024-51746.
• Patch all affected n8n installations to the latest secure version immediately.
• Audit logs for unauthorized access or unexpected file system modifications originating from the n8n process.