mirror of
https://github.com/lunchcat/sif.git
synced 2026-08-01 16:27:37 -07:00
TigahandGitHub
ed0cceb75a
add a recon module for an n8n instance that serves /rest/settings without authentication; the endpoint exists so the frontend can load but it discloses the webhook url structure, instance id, release channel, configured authentication method and whether owner setup is still pending, which aids reconnaissance and can indicate a claimable instance; it is unauthenticated by design so this is reported as information disclosure.
38 lines
810 B
YAML
38 lines
810 B
YAML
# n8n Settings Exposure Detection Module
|
|
|
|
id: n8n-settings-exposure
|
|
info:
|
|
name: n8n Settings Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects an n8n instance that leaks its instance id, auth method and owner-setup state over the unauthenticated settings endpoint
|
|
tags: [n8n, workflow, automation, low-code, information-disclosure, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/rest/settings"
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"endpointWebhook\""
|
|
- "\"versionCli\""
|
|
- "\"instanceId\""
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: n8n_version
|
|
part: body
|
|
regex:
|
|
- '"versionCli"\s*:\s*"([^"]+)"'
|
|
group: 1
|