PT-2022-23988 · Neo4J · Neo4J Apoc

Jonathan Leitschuh · Published 2022-08-12 · Updated 2022-08-16 · CVE-2022-37423

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Neo4j APOC versions 4.3.0.0 through 4.3.0.6 Neo4j APOC versions 4.4.0.0 through 4.4.0.7

Description A Directory Traversal issue exists, allowing access to sibling directories via the apoc.log.stream function. This issue is limited to sibling directories. For example, if a user-controlled path starts with "/usr/out", an attacker could access a directory named "/usr/outnot".

Recommendations For Neo4j APOC versions 4.3.0.0 through 4.3.0.6, update to version 4.3.0.7. For Neo4j APOC versions 4.4.0.0 through 4.4.0.7, update to version 4.4.0.8. As a temporary workaround, consider controlling the allowlist of functions that can be used in your system by configuring the dbms.security.procedures.allowlist setting.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-37423

GHSA-78F9-745F-278P

Affected Products

Neo4J Apoc

References · 10

• 🔥 https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p · Exploit
• 🔥 https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/d2f415c6f703bbc2cda4a753928821ff15d5c620 · Exploit
• 🔥 https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/fe9f8c77269f5a742585c1d62324eb70755de510 · Exploit
• 🔥 https://github.com/neo4j-contrib/neo4j-apoc-procedures/pull/3080 · Exploit
• 🔥 https://github.com/neo4j-contrib/neo4j-apoc-procedures · Exploit
• https://osv.dev/vulnerability/CVE-2022-37423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37423 · Security Note
• https://neo4j.com/docs/aura/platform/apoc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78f9-745f-278p · Vendor Advisory
• https://t.me/cibsecurity/48083 · Telegram Post