CVE-2025-49595

Executive Summary

CVE-2025-49595 is a denial of service (DoS) vulnerability in n8n, a workflow automation platform. The flaw resides in the /rest/binary-data endpoint, which fails to properly handle empty filesystem URIs (filesystem:// or filesystem-v2://). An authenticated attacker can send a crafted GET request with an empty filesystem URI, causing resource exhaustion and service unavailability. This has been confirmed to cause HTTP/2 524 timeout responses on n8n.cloud instances. The vulnerability is patched in version 1.99.0.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users should verify the integrity of their installation and ensure they are running a patched version. The vulnerability does not directly affect the npm supply chain, but the DoS vector can be exploited by any authenticated user, including those with low-privilege accounts.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)

The vulnerability is rated Medium due to the requirement for authentication, but the impact on availability is High. An attacker with low privileges can cause a complete service outage.

Deep Dive & Mechanics

The /rest/binary-data endpoint in n8n is designed to serve binary data files. It accepts a URI parameter that specifies the location of the binary data. The vulnerability occurs when the URI is set to an empty filesystem scheme, such as filesystem:// or filesystem-v2://.

When the server processes such a URI, it attempts to resolve the path and read the file. An empty path causes the server to enter an infinite loop or a state of resource exhaustion (e.g., memory or file descriptor leak), leading to a denial of service. The server becomes unresponsive, and HTTP requests time out (e.g., HTTP/2 524).

The root cause is insufficient validation of the URI scheme and path before attempting to access the filesystem. The fix in version 1.99.0 likely adds checks to reject empty or malformed filesystem URIs.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint handler
app.get('/rest/binary-data', (req, res) => {
  const uri = req.query.uri;
  if (uri.startsWith('filesystem://') || uri.startsWith('filesystem-v2://')) {
    const filePath = uri.replace(/^filesystem(-v2)?:\/\//, '');
    // No validation of filePath - empty string leads to resource exhaustion
    const data = fs.readFileSync(filePath); // Infinite loop or crash
    res.send(data);
  }
});

Patched Code (Conceptual):

// Patched endpoint handler
app.get('/rest/binary-data', (req, res) => {
  const uri = req.query.uri;
  if (uri.startsWith('filesystem://') || uri.startsWith('filesystem-v2://')) {
    const filePath = uri.replace(/^filesystem(-v2)?:\/\//, '');
    if (!filePath || filePath.trim() === '') {
      return res.status(400).send('Invalid URI');
    }
    // Additional validation to prevent resource exhaustion
    const data = fs.readFileSync(filePath);
    res.send(data);
  }
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an n8n instance (version < 1.99.0)
• Valid authentication credentials (any user role)

Exploitation Steps:

1. Authenticate to the n8n instance and obtain a session token or API key.
2. Send a GET request to the vulnerable endpoint with an empty filesystem URI:

   curl -X GET "https://target.n8n.instance/rest/binary-data?uri=filesystem://" \
        -H "Authorization: Bearer <token>"
   

3. Repeat the request multiple times to amplify the DoS effect.
4. Monitor the service availability; the server may become unresponsive.

Expected Outcome: The n8n service becomes unavailable, returning HTTP 524 timeouts or connection resets.

Blue Team

Detection:

• Monitor logs for repeated requests to /rest/binary-data with uri parameters containing filesystem:// or filesystem-v2://.
• Alert on high CPU/memory usage on the n8n server.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade n8n to version 1.99.0 or later.
• If upgrade is not possible, implement a WAF rule to block requests with empty filesystem URIs.
• Restrict access to the /rest/binary-data endpoint to trusted IPs or roles.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /rest/binary-data with uri=filesystem:// or uri=filesystem-v2://
  • HTTP response codes 524 (timeout) from n8n.cloud instances
• System IOCs:
  • High CPU usage on the n8n server process
  • Excessive file descriptor usage
  • Application logs showing repeated attempts to process empty filesystem URIs

Detection Engineering

YARA Rule

rule CVE_2025_49595_n8n_DoS {
   meta:
      description = "Detects exploitation attempts of CVE-2025-49595 in n8n logs"
      author = "Valters IT"
      date = "2025-04-10"
      reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-49595"
   strings:
      $uri1 = "filesystem://" ascii nocase
      $uri2 = "filesystem-v2://" ascii nocase
      $endpoint = "/rest/binary-data" ascii nocase
   condition:
      all of ($uri*) and $endpoint
}

Sigma Rule

title: CVE-2025-49595 n8n DoS Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the n8n /rest/binary-data endpoint with empty filesystem URIs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49595
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/rest/binary-data'
        cs-uri-query|contains: 
            - 'uri=filesystem://'
            - 'uri=filesystem-v2://'
    condition: selection
falsepositives:
    - Legitimate use of filesystem URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49595 n8n DoS Exploitation Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/rest/binary-data"; http.uri; content:"uri=filesystem://" or content:"uri=filesystem-v2://"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade n8n to version 1.99.0 or later.
2. Workaround: If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests containing filesystem:// or filesystem-v2:// in the uri parameter.
3. Access Control: Restrict access to the /rest/binary-data endpoint to only trusted users or IP addresses.
4. Monitoring: Enable logging and monitoring for the /rest/binary-data endpoint and set up alerts for anomalous request patterns.
5. Rate Limiting: Apply rate limiting to the /rest/binary-data endpoint to mitigate DoS attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence