GHSA-mgpr-56r4-5c67: n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.85 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.43.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.44.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed if they run a version before 1.123.85, a 2.x version before 2.43.5, or a 2.44.x version before 2.44.1 and use the affected Microsoft Outlook contact lookup or Microsoft SharePoint v1 item update nodes with expression-bindable parameters influenced by untrusted input.
What does an attacker need to exploit it?
An attacker needs to be able to supply untrusted input to a workflow that passes that input into the affected expression-bindable parameters. They can use injected single quotes in OData $filter values.
What can exploitation allow?
In Outlook contact lookup workflows, exploitation can dump the entire contact list for the mailbox associated with the stored credential. In SharePoint v1 item update workflows, it can redirect writes to unintended list items within the scope of the stored credential.
What versions address the issue?
Upgrade to 1.123.85 or later for the 1.x branch, 2.43.5 or later for applicable 2.x releases, or 2.44.1 or later for the 2.44.x branch.