T09 · Insecure Skill Coding Practices
Error
- Location
scripts/n8n_api.py:20- Finding
API Key Can Be Transmitted to an Untrusted or Insecure Endpoint
- Content
View full analysis
Dict[str, Any]: """Make API request""" url = f"{self.base_url}/api/v1/{endpoint.lstrip('/')}" response = self.session.request(method, url, **kwargs) ``` ### Technical Analysis The client accepts `N8N_BASE_URL` directly from the environment and uses it as the destination for requests carrying the privileged `X-N8N-API-KEY` header. It does not verify that: - The URL uses HTTPS. - The hostname is an approved n8n server. - The URL does not contain embedded credentials. - The port is expected. - Redirects remain on the approved origin. - A base URL was provided at all. Consequently, a manipulated configuration can direct authenticated requests to an attacker-controlled server or transmit the API key over plaintext HTTP. The use of a session-level custom authentication header increases the risk that the header remains attached during redirected requests unless redirect destinations are explicitly restricted. ### Attack Path 1. An attacker, compromised deployment mechanism, or untrusted configuration source modifies `N8N_BASE_URL`. 2. The value is set to an attacker-controlled URL or a plaintext HTTP endpoint. 3. A user runs any command that communicates with n8n, such as `list-workflows`, `get-workflow`, or `exe ...[truncated 830 chars]- Remediation
View remediation