n8n REST API exposed detector

[YuriyPobezhymov]

Detector for exposed n8n's REST API.
Testbed at google/security-testbeds#199

[robert-doyensec]

Thank you for the updates. A few suggestions to help debugging later. Is there any way a workflow could be created that executes code to be 100% sure that it is vulnerable? Let me know what you think related to that. There's a strong preference for using an RCE payload that sends an out of bound callback request using the T_CBS_URI variable if possible.

[robert-doyensec]

I think part of the recommendation should be to upgrade the n8n version since this only detects older versions

[YuriyPobezhymov]

Updated!

[YuriyPobezhymov]

@robert-doyensec, thanks for update.

Yes — that’s possible, but it will looks like another detector.

If unauthenticated access to /rest/workflows is available, a workflow can be created (or imported from a file definition) that includes an HTTP Request node (or Execute Command node, if enabled) pointing to {{T_CBS_URI}}. Triggering the workflow will result in an outbound request, providing a reliable OOB signal.

There may be some minor adjustments required depending on the n8n version (e.g., differences in REST paths or execution/activation flows across earlier and later 0.x releases).

[robert-doyensec]

LGTM - Approved
@tooryx , this can be merged alongside google/security-testbeds#199 .

Reviewer: Robert, Doyensec
Plugin: n8n Exposed UI Detector
Drawbacks:

• minor drawback of not actually executing a workflow, but it does demonstrate access to the workflows endpoint and fingerprints before doing so.
• affected versions are quite old, newer versions don't allow configuring unauthenticated access easily