Authentication Bypass in n8n Asana Trigger via X-Hook-Secret Header

Executive Summary

This vulnerability is an authentication bypass in n8n versions before 2.38.0 and 3.x before 3.0.1. It affects the Asana Trigger, allowing unauthenticated attackers who know the webhook URL to replace the secret by sending a request with an X-Hook-Secret header. This lets them forge Asana events that pass signature verification, trigger workflows with attacker-controlled data, and cause genuine deliveries to be rejected.

Useful 0 Not Useful 0

Detection Guidance

Check if your n8n instance is running a vulnerable version (before 2.38.0 or 3.x before 3.0.1) by running: n8n version. Inspect webhook logs for requests containing X-Hook-Secret headers without proper authentication. Monitor for unexpected secret resets or forged Asana events triggering workflows.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious data into workflows, disrupt legitimate Asana event processing, and potentially compromise downstream systems relying on n8n workflows. The attack requires network access but no privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data processing or modification, violating integrity and availability requirements in GDPR and HIPAA. It may cause data breaches or loss of audit trails, increasing compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade n8n to version 2.38.0 or later immediately. Temporarily restrict network access to the webhook endpoint or deactivate Asana Trigger workflows until patched. Review and rotate all webhook secrets if exposed.

Useful 0 Not Useful 0