Path Traversal in Neo4j Awesome Procedures On Cyper
CVE-2022-23532
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12 and 5.3.1. As a workaround, you can control the allowlist of the procedures that can be used in your system, and/or turn off local file access by setting apoc.export.file.enabled=false.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.007 (47.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L.
Affected products
- Neo4j Awesome_procedures_on_cyper — versions 5.3.0
- Neo4j-contrib Neo4j-apoc-procedures — versions < 4.3.0.12, >= 4.4.0.0, < 4.4.0.12
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-23532?
- CVE-2022-23532 is a high-severity vulnerability in Neo4j Awesome Procedures On Cyper, classified under Path Traversal. CVSS score: 7.1/10. Published 2023-01-14.
- How severe is CVE-2022-23532?
- High severity. CVSS v3 base score is 7.1 out of 10.