PT-2021-20483 · Neo4J · Neo4J

Published 2021-08-05 · Updated 2024-03-06 · CVE-2021-34371

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Neo4j versions prior to 3.4.18

Description: The issue allows for remote code execution due to the arbitrary deserialization of Java objects. This can be achieved through the setSessionVariable function, which is part of the RMI service exposed when the shell server is enabled. The presence of dependencies with exploitable gadget chains makes this possible.

Recommendations: For versions prior to 3.4.18, consider disabling the shell server to prevent exposure of the RMI service as a temporary workaround. Restrict access to the setSessionVariable function to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-NEO4J-2021-34371

CVE-2021-34371

GHSA-PC4W-8V5J-29W9

Affected Products

Neo4J

References · 7

• 🔥 https://github.com/zwjjustdoit/CVE-2021-34371.jar · Exploit
• 🔥 https://exploit-db.com/exploits/50170 · Exploit
• https://osv.dev/vulnerability/BIT-neo4j-2021-34371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34371 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34371 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pc4w-8v5j-29w9 · Vendor Advisory
• https://github.com/neo4j/neo4j · Note