Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-27564

CVE-2023-27564:
n8n Information Disclosure vulnerability

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-27564
GHSA ID
GHSA-r9xw-p7wj-w792
EPSS Score
0.8539%
CWE
CWE-668
Published
5/10/2023
Updated
11/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
n8nnpm< 0.216.10.216.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from an overly permissive authentication bypass in the setupAuthMiddlewares function. The pre-patch code explicitly excluded authentication for URLs containing '.svg' and other static asset paths via direct string matching (req.url.includes('.svg')). This allowed attackers to access protected resources by appending '.svg' to endpoints or accessing static assets improperly. The patch replaced this insecure explicit bypass with a controlled glob pattern matching validated static assets from a known directory (EDITOR_UI_DIST_DIR), ensuring only legitimate static files bypass authentication. The CWE-668 (Exposure of Resource to Wrong Sphere) directly maps to this authentication bypass mechanism.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** n*n p**k*** prior to *.***.* *or No**.js *llows In*orm*tion *is*losur*.

Reasoning

T** vuln*r**ility st*mm** *rom *n ov*rly p*rmissiv* *ut**nti**tion *yp*ss in t** s*tup*ut*Mi**l*w*r*s *un*tion. T** pr*-p*t** *o** *xpli*itly *x*lu*** *ut**nti**tion *or URLs *ont*inin* '.sv*' *n* ot**r st*ti* *ss*t p*t*s vi* *ir**t strin* m*t**in* (