Mahmoud0X00

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.106.0 Description: n8n is a workflow automation platform. A symlink traversal vulnerability was discovered in the `Read/Write File` node. The node does not properly account for symbolic links (symlinks), allowing an attacker with the ability to create symlinks—such as by using the `Execute Command` node—to bypass directory restrictions and read from or write to otherwise inaccessible paths. Users of n8n.cloud are not impacted. Recommendations: Update to version 1.106.0 or later. As a temporary workaround, disable or restrict access to the `Execute Command` node and any other nodes that allow arbitrary file system access. Avoid using the `Read/Write File` node on untrusted paths or inputs that could be manipulated via symlinks.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.90.0 **Description** The issue concerns stored Cross-Site Scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter, allowing the server to respond with any MIME type. This could enable malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to `text/html`, the script executes in the context of the user’s session, potentially allowing account takeover by changing the user’s email address in their account settings. **Recommendations** For versions prior to 1.90.0, update to version 1.90.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the attachments view endpoint and limiting the types of files that can be uploaded to prevent malicious content from being served. Additionally, restrict the use of the GET parameter that controls the MIME type to prevent attackers from manipulating the server's response.

**Name of the Vulnerable Software and Affected Versions** Sandbox Accounts for Events versions prior to 1.1.0 **Description** The issue allows authenticated users to potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, and it is not possible to access AWS accounts in use or existing data/infrastructure. **Recommendations** For versions prior to 1.1.0, update to version 1.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the account API to minimize the risk of exploitation. Avoid using the API to claim empty AWS accounts with non-existent event ids until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Sandbox Accounts for Events versions prior to 1.10.0 **Description** The issue allows authenticated users to potentially read data from the events table by sending request payloads to the "events API", collecting information on planned events, timeframes, budgets, and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. **Recommendations** For versions prior to 1.10.0, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider restricting access to the "events API" to minimize the risk of exploitation. Avoid using the events API to collect sensitive information until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** @uppy/companion versions prior to 1.13.2 @uppy/companion versions prior to 2.0.0-alpha.5 **Description** The issue allows an attacker to perform a Server-Side Request Forgery (SSRF) attack, enabling them to scan local or external networks or interact with internal systems. This can lead to unauthorized access and potential data breaches. **Recommendations** For versions prior to 1.13.2, update to version 1.13.2 or later. For versions prior to 2.0.0-alpha.5, update to version 2.0.0-alpha.5 or later.