Attack Chain

1. An attacker obtains valid authentication credentials for an n8n instance, either through brute-force, phishing, or other means.
2. The authenticated attacker then accesses the n8n web interface to create or modify an existing workflow.
3. Within the workflow editor, the attacker specifically targets and configures an n8n Git node.
4. The attacker injects malicious commands or code into a parameter or field within the Git node's configuration that is not properly sanitized.
5. When the workflow containing the malicious Git node configuration is executed, the injected commands are processed and executed by the underlying operating system with the privileges of the n8n application.
6. This successful execution allows the attacker to achieve arbitrary code execution on the host server, enabling potential data exfiltration, further system compromise, or deployment of additional malware.

Impact

A successful exploitation of this authenticated code execution vulnerability grants an attacker the ability to run arbitrary commands on the server hosting the n8n instance. This level of access can lead to severe consequences, including full compromise of the n8n application and its data, unauthorized access to sensitive information flowing through integrated workflows, modification or deletion of critical business data, and disruption of automated processes. Furthermore, an attacker could leverage this initial foothold for lateral movement within the network, potentially compromising other systems and expanding the scope of the breach.

Recommendation

• Apply Patches: Immediately upgrade all affected n8n instances to version 1.123.67, 2.32.1, or 2.31.5, or a newer stable release. This directly remediates the authenticated code execution vulnerability (GHSA-rcv6-pvrj-4xcg).
• Review Advisories: Consult the n8n security advisories (available via the references section) for any additional mitigation steps or specific configuration changes recommended by the vendor.
• Log Monitoring: Enable robust process creation and network connection logging on the host system running n8n. Monitor these logs for any unusual or unauthorized processes launched by the n8n application's user account, or unexpected outbound network connections originating from n8n.