CVE-2024-44009 & CVE-2024-44010: n8n Workflow Automation Critical Vulnerabilities — Detection and Remediation

---
title: Potential n8n Path Traversal Exploitation (CVE-2024-44010)
id: 123e4567-e89b-12d3-a456-426614174000
status: experimental
description: Detects potential path traversal attempts targeting n8n workflows via URL patterns.
references:
  - https://www.infosecurity-magazine.com/news/two-critical-flaws-in-n8n-ai/
author: Security Arsenal
date: 2024/09/20
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: web
  product: nginx
  # Adjust product to apache, iis, or aws-cloudfront based on your env
detection:
  selection:
    c_uri|contains:
      - '..'
      - '%2e%2e'
      - 'etc/passwd'
    cs_uri_query|contains:
      - 'path='
  condition: selection
falsepositives:
  - Scanning activity
  - Misconfigured web proxies
level: high
---
title: n8n Node.js Process Spawning Shell (RCE Indicator)
id: 87654321-e89b-12d3-a456-426614174001
status: experimental
description: Detects the n8n Node.js process spawning a shell, indicative of successful RCE.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2024/09/20
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/node'
    ParentCommandLine|contains: 'n8n'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative scripts executed by n8n (rare)
level: critical
---
title: Suspicious File Access by n8n Process (Linux Auditd)
id: a1b2c3d4-e89b-12d3-a456-426614174002
status: experimental
description: Detects n8n process accessing sensitive system files (e.g., /etc/passwd, .env) via syscall auditing.
references:
  - https://www.infosecurity-magazine.com/news/two-critical-flaws-in-n8n-ai/
author: Security Arsenal
date: 2024/09/20
tags:
  - attack.credential_access
  - attack.t1005
logsource:
  product: linux
  service: auditd
detection:
  selection:
    exe|endswith: '/node'
    type: 'PATH'
    name|contains:
      - '/etc/passwd'
      - '/etc/shadow'
      - '.env'
      - '/root/.ssh'
  condition: selection
falsepositives:
  - Unknown
level: high

// Hunt for n8n Node.js process spawning shells (RCE)
DeviceProcessEvents
| where InitiatingProcessFileName =~ "node" 
| where InitiatingProcessCommandLine contains "n8n"
| where FileName in~ ("bash", "sh", "zsh", "pwsh", "powershell.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')


// Hunt for suspicious URL patterns indicative of Path Traversal (CEF/Syslog)
CommonSecurityLog
| where RequestURL contains ".." 
   or RequestURL contains "%2e%2e"
| where DeviceProduct in~ ("n8n", "NGINX", "Apache")
| project Timestamp, DeviceName, SourceIP, DestinationIP, RequestURL, DeviceAction
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')

-- Hunt for n8n processes accessing sensitive files or spawning shells
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name = "node"
  AND CommandLine =~ "n8n"

-- Chain with process tree to look for children
SELECT Parent.Name AS ParentName, Child.Name AS ChildName, Child.Pid, Child.CommandLine
FROM pslist()
LEFT JOIN pslist() AS Parent ON Parent.Pid = Child.Ppid
WHERE Parent.Name = "node" 
  AND Parent.CommandLine =~ "n8n"
  AND Child.Name IN ("bash", "sh", "dash", "zsh")

#!/bin/bash
# n8n Vulnerability Remediation Script (CVE-2024-44009 / CVE-2024-44010)
# Checks version and updates for both NPM and Docker installations

echo "[*] Checking n8n installation type..."

# Check if Docker is running n8n
if docker ps --format '{{.Image}}' | grep -q 'n8nio/n8n'; then
    echo "[+] n8n detected running in Docker."
    CONTAINER_ID=$(docker ps --filter ancestor=n8nio/n8n --format "{{.ID}}")
    CURRENT_VERSION=$(docker exec $CONTAINER_ID n8n --version 2>/dev/null || echo "Unknown")
    echo "[!] Current Version: $CURRENT_VERSION"
    echo "[*] Pulling latest image and recreating container..."
    docker pull n8nio/n8n:latest
    docker stop $CONTAINER_ID
    docker rm $CONTAINER_ID
    # Note: Users must re-run their original 'docker run' command with volume mappings
    echo "[+] Image updated. Please restart your container with your specific configuration."

# Check if NPM installation exists
elif command -v npx &> /dev/null; then
    CURRENT_VERSION=$(npx n8n --version)
    echo "[+] n8n detected via NPM. Current Version: $CURRENT_VERSION"
    echo "[*] Updating n8n to latest version..."
    npm update -g n8n
    NEW_VERSION=$(npx n8n --version)
    echo "[+] Updated to Version: $NEW_VERSION"
    
    # Verify rotation of encryption keys if compromise is suspected
    echo "[WARNING] If you suspect exploitation, rotate your N8N_ENCRYPTION_KEY immediately."
else
    echo "[-] n8n installation not found via Docker or NPM in standard paths."
fi

echo "[*] Remediation check complete."