Description

Detects when a Webhook node in the published version of an n8n workflow trusts its IP allowlist alone, with no authentication of its own, while its Allowed Origins (CORS) option is unset, *, a list led by * or one that names null, and the webhook answers with the workflow's data or takes a method that a browser sends only after asking. A page that someone inside one of the allowed networks opens can then call the webhook from that person's browser, which the allowlist lets in, and read what the workflow returns or send it a PUT, PATCH or DELETE request.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Keeps the Webhook nodes that limit their callers with an IP allowlist, leaving out a node whose Authentication option is basicAuth, bearerAuth, headerAuth, jwtAuth, n8nOAuth2 or an expression in double braces; an option left unset counts as None, the n8n default

• Reads the Allowed Origins (CORS) option as written and counts it as open when it is unset, the n8n default being *, when it is empty, when its list starts with *, or when it names null

• Reports a vulnerability when the origins are open and the node also answers with workflow data (responseMode responseNode or streaming, or lastNode unless responseData is noData) or accepts PUT, PATCH or DELETE, and records the origins, what a page gains and the IP allowlist in the evidence; a workflow whose listing omits the published version field, or whose published version has no node list, is recorded as unreadable rather than reported as clean