PT-2023-12726 · Neo4J · Neo4J Graph Database
Adam Reziouk
·
Published
2023-01-13
·
Updated
2023-01-24
·
CVE-2022-23532
CVSS v3.1
7.1
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
APOC versions prior to 4.4.0.12
APOC versions prior to 4.3.0.12
APOC versions prior to 5.3.1
Description
A path traversal issue found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database allows a malicious actor to potentially break out of the expected directory. The issue is such that files could only be created but not overwritten. For the issue to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The procedure would need to have been allow listed in the neo4j configuration as well as having the apoc config
apoc.export.file.enabled set to true.Recommendations
For versions prior to 4.4.0.12, update to version 4.4.0.12 or later.
For versions prior to 4.3.0.12, update to version 4.3.0.12 or later.
For versions prior to 5.3.1, update to version 5.3.1 or later.
As a temporary workaround, consider controlling the allowlist of procedures that can be used in your system, and/or turn off local file access by setting
apoc.export.file.enabled to false.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Neo4J Graph Database