Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application. Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. Patches The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this…
Recommended action: Upgrade to 5.5.0 or 4.4.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Path Traversal Vulnerability found in the apoc.export. procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The procedure would need to have been allow listed in the neo4j configuration as well as having the apoc config apoc.export.file.enabled set to true. On a UNIX based system the following query allows arbitrary write access to the tmp folder: CALL apoc.export.csv.query('RETURN 1', 'file:///..//..//..//..//tmp/test.txt', {}) Patches The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability are 4.4.0.12…
Recommended action: Upgrade to 4.4.0.12 or 4.3.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A partial Directory Traversal Vulnerability found in apoc.log.stream function of apoc plugins in Neo4j Graph database. This issue allows a malicious actor to potentially break out of the expected directory. The impact is limited to sibling directories. For example, userControlled.getCanonicalPath().startsWith("/usr/out") will allow an attacker to access a directory with a name like /usr/outnot. Patches The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability are 4.4.0.8 and 4.3.0.7 Workarounds If you cannot upgrade the library, you can control the allowlist of the functions that can be used in your system For more information If you have any questions or comments about this advisory: - Open an issue in neo4j-apoc-procedures - Email us at security@neo4j.com Credits We want to publicly recognise the contribution of Jonathan Leitschuh for reporting this issue.
Recommended action: Upgrade to 4.4.0.8 or 4.3.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Directory Traversal Vulnerabilities found in several functions of apoc plugins in Neo4j Graph database. The attacker can retrieve and download files from outside the configured directory on the affected server. Under some circumstances, the attacker can also create files. Patches The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability (for Neo4j 4.2, 4.3, and 4.4 bundled with APOC, upgrade to the appropriate patched version): 3.5 - bundle n/a, standalone 3.5.0.17 4.2 - bundle 4.2.13, standalone 4.2.0.10 4.3 - bundle 4.3.9, standalone 4.3.0.4 4.4 - bundle 4.4.2, standalone 4.4.0.1 Workarounds If you cannot upgrade the library, you can control the allowlist of the functions that can be used in your system: For more information If you have any questions or comments about this advisory: Open an issue in neo4j-apoc-procedures Email us at security@neo4j.com Credits We want to publicly…
Recommended action: Upgrade to 4.4.0.1, 4.3.0.4, 4.2.10 or 3.5.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.
Recommended action: Upgrade to 3.4.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.