n8n Authenticated SSRF via Dynamic Node Parameters Endpoints Advisory

Vulnerability Overview Vulnerability Name: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access Vulnerability Description: The endpoint in lacks authorization scoping, allowing any authenticated user to access the endpoint without creating or executing a workflow. By providing an absolute URL as part of the route configuration, an attacker can override the declared by the node type, thereby bypassing restrictions and enabling the server to send HTTP requests to arbitrary internal targets. Affected Versions Affected Versions: - = 1.123.64 - >= 2.30.1 - >= 2.29.8 Remediation Patch: - This issue has been fixed in versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to these versions or later to mitigate the vulnerability. Temporary Mitigations: - If an immediate upgrade is not possible, administrators should consider the following temporary mitigations: - Restrict access to instances to fully trusted users only. - Set to enable SSRF filtering, preventing access to private IP ranges and cloud metadata endpoints. - Restrict network egress from the host to reachable internal services. These mitigations do not fully resolve the risk and should only be used as short-term measures. Additional Information CVSS v4 Base Metrics: - Severity: 6.3 / 10 - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Low - Privileges Required: Low - User Interaction: None - Affected System Impact Metrics: - Confidentiality: Low - Integrity: Low - Availability: None - Subsequent System Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: None CVE ID: No known CVE Weakness: No CWE Credit: @1246h --- Summary This vulnerability allows authenticated users to perform SSRF attacks via the endpoint to access internal networks. Affected versions should be upgraded to 1.123.64, 2.29.8, or 2.30.1 to fix the issue. Temporary mitigations include restricting access, enabling SSRF filtering, and restricting network egress.

Goal Reached Thanks to every supporter — we hit 100%!

n8n Authenticated SSRF via Dynamic Node Parameters Endpoints Advisory

More from this source