Stored XSS in n8n Chat Trigger Node

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue found in the n8n software, specifically in the Chat Trigger node's Custom CSS field. It occurs because of a misconfiguration in the sanitize-html library used by n8n. An authenticated user who has permission to create or modify workflows can inject malicious JavaScript code that bypasses the sanitization process. This malicious code is then stored and executed whenever any user visits the public chat page.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored cross-site scripting (XSS) issue in the Custom CSS field of the Chat Trigger node in n8n. Detection involves identifying if your n8n instance is running a vulnerable version and if any workflows contain malicious JavaScript injected into this field.

To detect the vulnerability on your system, you should first verify the version of n8n you are running. Versions before 1.123.27, 2.13.3, and 2.14.1 are vulnerable.

You can check the n8n version by running the following command on the server hosting n8n:

• n8n --version

To detect if any workflows contain malicious JavaScript in the Chat Trigger node's Custom CSS field, you can query the database or export workflows and search for suspicious script tags or JavaScript code in the Custom CSS field.

For example, if you have access to the database (e.g., PostgreSQL), you might run a query like:

• SELECT id, name, settings FROM workflows WHERE settings::text LIKE '%<script>%' OR settings::text LIKE '%javascript:%';

Alternatively, export workflows via the n8n UI or API and search for suspicious content in the Custom CSS field.

Note that detection of exploitation attempts on the network level is difficult because the attack requires an authenticated user with workflow modification permissions and user interaction to trigger the stored XSS.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker with certain permissions can inject malicious JavaScript into the application, which will be executed in the browsers of users who visit the affected public chat page. This can lead to unauthorized actions such as stealing user session data, performing actions on behalf of users, or delivering further malicious payloads. The vulnerability affects confidentiality and integrity but does not impact availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update n8n to a fixed version. The vulnerability is fixed in versions 1.123.27, 2.13.3, and 2.14.1. Ensure that your installation is upgraded to at least one of these versions or later.

Additionally, restrict permissions so that only trusted authenticated users can create or modify workflows, as the vulnerability requires such permissions to exploit.

Useful 0 Not Useful 0