Listen to this Post
The Stripe Trigger node in n8n creates a webhook endpoint with a stored Stripe signing secret for verification. The vulnerability exists because incoming HTTP POST requests to this webhook endpoint were not validated against the stored secret. The system only checked if the incoming event type matched a trigger condition, not the request’s authenticity. Therefore, any actor who discovers or guesses the high-entropy UUID in the webhook URL can craft a malicious HTTP request with a falsified Stripe event payload. This request bypasses authentication because the lack of signature verification means n8n cannot distinguish it from a legitimate Stripe webhook. The forged event is then processed by the workflow, executing all subsequent nodes as if triggered by a real Stripe event, leading to unauthorized workflow execution.
Platform: n8n
Version: < 2.2.2
Vulnerability: Webhook Auth Bypass
Severity: Critical
Date:
Prediction: Patch Released
What Undercode Say:
Analytics
Check n8n version grep -i version /usr/lib/n8n/package.json Find exposed webhook endpoints (example pattern) sudo netstat -tlnp | grep :5678 sudo lsof -i :5678 Monitor for unverified POST requests to webhook paths sudo tail -f /var/log/n8n.log | grep -E "(webhook|stripe)" | grep -v "signature"
How Exploit:
Crafting a forged Stripe webhook event
curl -X POST https://victim.n8n.cloud/webhook-test/8a7s6d9a-... \
-H "Content-Type: application/json" \
-d '{"type": "customer.subscription.created", "data": {...}}'
Protection from this CVE
Upgrade to n8n version 2.2.2 or later immediately. This patch implements proper Stripe webhook signature verification using the stored secret. If immediate upgrade is impossible, deactivate all workflows using the Stripe Trigger node. Restrict access to the n8n instance and workflow editor to trusted users only, as authenticated users can view webhook IDs.
Impact:
Unauthenticated workflow execution. Potential fake payment events. Downstream process manipulation. Data integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
