Listen to this Post
The vulnerability in n8n’s Webhook node stems from flawed IP whitelist validation logic that uses partial string matching rather than exact IP address comparison. When an incoming request arrives, the system checks the source IP against configured whitelist entries by verifying if the whitelist string is a substring of the source IP string. For instance, if the whitelist contains “192.168.1.1”, an attacker with IP “192.168.1.10” is granted access because “192.168.1.1” appears within “192.168.1.10”. This occurs due to improper string parsing without converting IPs to canonical forms or using network byte comparison. The issue affects both IPv4 and IPv6 addresses, allowing bypass if the attacker’s IP shares a prefix with a trusted entry. For IPv6, if whitelist has “2001:db8::1”, IP “2001:db8::1234” matches. The flaw enables unauthorized webhook activation by crafting requests from IPs that partially match trusted entries, undermining IP-based access controls. Validation should use exact match after normalizing IPs, but instead substring matching permits unintended access. This vulnerability exists in versions prior to 2.2.0, where the patch implements strict IP comparison.
Platform: n8n
Version: <2.2.0
Vulnerability: IP Whitelist Bypass
Severity: Medium
Date: 2024-04-15
Prediction: Patched v2.2.0
What Undercode Say:
Analytics
Simulate flawed substring matching whitelist="192.168.1.1" source_ip="192.168.1.10" if [[ $source_ip == "$whitelist" ]]; then echo "Access granted (flawed match)" fi
Python code demonstrating vulnerability
def flawed_ip_match(whitelist_ip, source_ip):
return whitelist_ip in source_ip Partial string match
print(flawed_ip_match("192.168.1.1", "192.168.1.10")) True
Exploit
Attacker uses IP address sharing prefix with whitelisted entry to bypass validation.
Protection from this CVE
Upgrade to v2.2.0, implement authentication mechanisms, use network-layer filtering.
Impact
Unauthorized webhook access, IP control bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
