n8n Send Email Node Arbitrary File Read and SSRF Vulnerability (GHSA-2x35-3fw4-9jr4)

Vulnerability Overview Vulnerability Name: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion Vulnerability ID: GHSA-2x35-3fw4-9jr4 Severity: High (CVSS v4 base metrics: 8.2/10) Publication Date: January 3, 2023 Scope of Impact Affected Versions: - = 1.123.67 - >= 2.32.1 - >= 2.31.5 Vulnerability Description Impact: The n8n Send Email node does not enforce its message fields to be strings. Consequently, untrusted non-string values can be created via workflow expressions, potentially leading to local file disclosure. Exploitation Prerequisites: A pre-existing workflow, an unauthenticated webhook, valid SMTP credentials, and untrusted input directly mapped to the text or HTML email body. Remediation Patch: The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to these versions or later to resolve the vulnerability. Temporary Mitigations Audit workflows for Send Email nodes that directly map untrusted webhooks or external data to the text or HTML email body, and remove or restrict these workflows. Restrict public webhook access at the network or reverse proxy level to prevent unauthorized callers from accessing sensitive workflows. Restrict workflow creation and editing permissions to trusted users only. Additional Information CVSS v4 base metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: None - Availability: None Subsequent System Impact Metrics: - Confidentiality: Low - Integrity: None - Availability: None Credits Reporter: simonkoeck

Goal Reached Thanks to every supporter — we hit 100%!

n8n Send Email Node Arbitrary File Read and SSRF Vulnerability (GHSA-2x35-3fw4-9jr4)

More from this source