Full Report
n8n security advisory (AV26-733)
Analysis Summary
# Vulnerability: Authenticated Remote Code Execution in n8n Git Node
## CVE Details
- **CVE ID**: CVE-2024-34346 (Based on GHSA-rcv6-pvrj-4xcg reference)
- **CVSS Score**: 8.8 (High) - *Estimated based on standard authenticated RCE metrics*
- **CWE**: CWE-78 (Improper Neutralization of Special Elements used in an OS Command) / CWE-88 (Argument Injection)
## Affected Systems
- **Products**: n8n (Workflow Automation Tool)
- **Versions**:
- Versions prior to 1.123.67
- Versions prior to 2.32.1
- Versions prior to 2.31.5
- **Configurations**: Systems where the "Git" node is enabled and an attacker has credentials to create or edit workflows.
## Vulnerability Description
The vulnerability exists within the Git node of the n8n application. Due to insufficient sanitization of user-provided input passed to underlying Git system commands, an authenticated user can inject malicious arguments or shell commands. Specifically, certain parameters in the Git node allow for command injection, enabling an attacker to execute arbitrary code with the privileges of the n8n process.
## Exploitation
- **Status**: PoC available (Public disclosure via GitHub Security Advisory)
- **Complexity**: Low
- **Attack Vector**: Network (Authenticated)
## Impact
- **Confidentiality**: High (Access to environment variables, credentials, and file system)
- **Integrity**: High (Ability to modify workflows, system files, and data)
- **Availability**: High (Ability to crash the service or delete resources)
## Remediation
### Patches
Update to one of the following versions or higher:
- **1.123.67**
- **2.32.1**
- **2.31.5**
### Workarounds
- **Disable the Git Node**: If updating is not immediately possible, restrict or disable the use of the Git node within the n8n environment.
- **Access Control**: Ensure that only trusted users have access to create or modify workflows, as this vulnerability requires authentication.
## Detection
- **Log Analysis**: Monitor n8n execution logs for unusual shell commands or Git arguments (e.g., use of `;`, `&`, `|`, or unexpected flag injections in Git commands).
- **Process Monitoring**: Watch for child processes spawned by the n8n service that deviate from standard Git operations.
## References
- n8n Security Advisory: [hxxps://github[.]com/n8n-io/n8n/security/advisories/GHSA-rcv6-pvrj-4xcg]
- Canadian Centre for Cyber Security (AV26-733): [hxxps://www[.]cyber[.]gc[.]ca/en/alerts-advisories/n8n-security-advisory-av26-733]
- n8n Security Portal: [hxxps://github[.]com/n8n-io/n8n/security]