Description

Detects when an FTP node in the published version of an n8n workflow uses the FTP protocol, the node's default, and n8n opens that connection without TLS. The node then sends its login to the server, and the files and folder listings it transfers, in clear text, so anyone who can watch the network between the n8n host and the FTP server can read those credentials and files, and alter the files on their way.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Keeps the FTP nodes and reads their Protocol option, an option left unset counting as FTP, the n8n default

• Reports a vulnerability when the protocol is FTP, which n8n opens without TLS, and records the protocol in the evidence; a workflow whose listing omits the published version field, or whose published version has no node list, is recorded as unreadable rather than reported as clean