EUVD-2025-201815

Comprehensive Technical Analysis of EUVD-2025-201815

1. Vulnerability Assessment and Severity Evaluation

The vulnerability described in EUVD-2025-201815 affects n8n, an open-source workflow automation platform. The issue arises from inadequate protections against Remote Code Execution (RCE) through the project's pre-commit hooks. Specifically, the Add Config operation allows workflows to set arbitrary Git configuration values, including core.hooksPath, which can be manipulated to point to a malicious Git hook. This hook can then execute arbitrary commands on the n8n host during subsequent Git operations.

Severity Evaluation:

• Base Score: 9.4 (Critical)
• Base Score Version: 4.0
• Base Score Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The high base score indicates a critical vulnerability due to the potential for high confidentiality, integrity, and availability impacts. The attack vector is network-based, requires low complexity, and does not need user interaction. However, it requires low privileges, meaning an attacker needs some level of access to the n8n workflow.

2. Potential Attack Vectors and Exploitation Methods

Attack Vectors:

1. Malicious Workflow Creation: An attacker with the ability to create or modify an n8n workflow can set the core.hooksPath to a malicious Git hook.
2. Untrusted Repositories: Cloning or interacting with untrusted repositories using the Git Node can introduce malicious hooks.

Exploitation Methods:

1. Arbitrary Command Execution: By setting core.hooksPath to a directory containing a malicious pre-commit hook, an attacker can execute arbitrary commands on the n8n host.
2. Persistent Attacks: Once the malicious hook is in place, it can execute commands during any subsequent Git operations, leading to persistent attacks.

3. Affected Systems and Software Versions

Affected Versions:

• n8n versions 0.123.1 through 1.119.1

Fixed Version:

• The issue is resolved in version 1.119.2.

Affected Systems:

• Any system running the vulnerable versions of n8n, particularly those that allow workflow creation or modification and use the Git Node.

4. Recommended Mitigation Strategies

1. Upgrade to the Latest Version: Upgrade n8n to version 1.119.2 or later to mitigate the vulnerability.
2. Exclude the Git Node: As a temporary workaround, exclude the Git Node from workflows to prevent the exploitation of this vulnerability.
3. Avoid Untrusted Repositories: Do not clone or interact with untrusted repositories using the Git Node.
4. Monitor and Audit Workflows: Regularly monitor and audit workflows to detect and remove any suspicious configurations.
5. Implement Access Controls: Ensure that only trusted users have the ability to create or modify workflows.

5. Impact on European Cybersecurity Landscape

The vulnerability poses a significant risk to organizations using n8n for workflow automation, particularly those in critical sectors such as finance, healthcare, and government. The potential for RCE can lead to data breaches, system compromises, and disruptions in service, impacting the overall cybersecurity posture of affected organizations.

Given the widespread use of n8n and its integration with various systems, the vulnerability highlights the importance of timely patching and continuous monitoring. It also underscores the need for robust security practices in open-source projects, which are increasingly becoming targets for cyber threats.

6. Technical Details for Security Professionals

Technical Overview:

• Vulnerable Component: The Add Config operation in n8n workflows.
• Exploitable Configuration: core.hooksPath in Git configuration.
• Exploitation Steps:
  1. Create or modify an n8n workflow to set core.hooksPath to a directory containing a malicious pre-commit hook.
  2. The malicious hook executes arbitrary commands during subsequent Git operations.

Detection and Response:

• Detection: Monitor for unusual Git configurations and workflow modifications. Use intrusion detection systems (IDS) to detect suspicious activities.
• Response: Immediately upgrade to the patched version. Conduct a thorough audit of workflows and Git configurations to identify and remove any malicious hooks.

References:

• GitHub Security Advisory
• Commit Fixing the Issue
• n8n GitHub Repository
• n8n Release Notes
• n8n Documentation on Excluding Nodes

By following these recommendations and staying vigilant, organizations can effectively mitigate the risks associated with this vulnerability and enhance their overall cybersecurity posture.