Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly states that 'the affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject.' I first attempted to find the specific commit that introduced this fix by comparing versions, but the initial commits found were release commits that only updated version numbers. By fetching the content of the specified file from a patched version (n8n@2.37.7), I confirmed the presence of the await subworkflowPolicyChecker.checkForProject(workflow, context.projectId); line within the executeWorkflow function. This directly corroborates the vulnerability description, indicating that the absence of this line in prior versions constituted the vulnerability. Therefore, the executeWorkflow function is the precise vulnerable function, as it was the point where the authorization check was missing.
executeWorkflowpackages/cli/src/modules/agents/tools/workflow-tool-factory.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n | npm | >= 2.38.0, < 2.38.2 | 2.38.2 |
| n8n | npm | < 2.37.7 | 2.37.7 |