RCE in n8n Git Clone Node via Race Condition (GHSA-g3r5-9h93-4j2c)

Vulnerability Overview Vulnerability Name: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution Vulnerability ID: GHSA-g3r5-9h93-4j2c Severity: High (8.9/10) Publication Date: 2 weeks ago Scope of Impact Affected Versions: - = 1.123.64 - >= 2.30.1 - >= 2.29.8 Impact Description: - A TOCTOU (Time-of-Check to Time-of-Use) race condition in the Git clone node allows authenticated users to bypass path restrictions by swapping directories. This enables the node to be loaded as a custom node upon the next restart, leading to arbitrary code execution. - All self-hosted and cloud instances are impacted where authenticated users can create and run workflows utilizing the Git node. Remediation Patch: - Users should upgrade to the available patched versions to resolve the vulnerability. Temporary Mitigation: - Restrict access to n8n instances to fully trusted users only. - Disable the Git node by adding to the environment variable. - Restrict egress network traffic from n8n instances to prevent connections to attacker-controlled Git repositories. Additional Information CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: Low - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: High - Availability: High Subsequent System Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: Low CVE ID: No known CVE Weakness: No known CWE Code Samples No POC code or exploitation code available.

Goal Reached Thanks to every supporter — we hit 100%!

RCE in n8n Git Clone Node via Race Condition (GHSA-g3r5-9h93-4j2c)

More from this source