Description

Detects when an Execute Workflow node in the published version of an n8n workflow sets the workflow it runs with an expression, in the workflow JSON given in the node, the URL it loads the workflow from or the path of the file it reads it from, and a Webhook, Form Trigger or public Chat Trigger that does not authenticate who calls it leads to that node. Anyone who can reach the trigger can start the workflow with data of their choosing, and when the expression builds that field from the data, an outsider can choose the workflow that the node runs on the instance.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published

• Starts from the Webhook, Form Trigger and public Chat Trigger nodes that the trigger authentication rules report, skipping disabled ones, and follows their main connections forward, through every output of a node and through disabled nodes

• Keeps the Execute Workflow nodes, skipping disabled ones, and reads the field their source selects: workflowJson for parameter, workflowUrl for url and workflowPath for localFile. A field counts as written as an expression when it starts with = and contains double braces. The database source, which is the default, runs a saved workflow that is scanned on its own, so it is not reported

• Reports a vulnerability when a reached node has that field written as an expression, and records in the evidence each such node with its source and the first trigger, in node order, that reaches it, never the expression; a workflow whose listing omits the published version field, or whose published version has no node list or no connections, is recorded as unreadable rather than reported as clean