Path Traversal in Neo4j Awesome Procedures On Cyper
CVE-2022-23532
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12 and 5.3.1. As a workaround, you can control the allowlist of the procedures that can be used in your system, and/or turn off local file access by setting apoc.export.file.enabled=false.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.007 (49.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Neo4j Awesome Procedures On Cyper — versions 5.3.0
- Neo4j-Contrib Neo4j-Apoc-Procedures — versions < 4.3.0.12, >= 4.4.0.0, < 4.4.0.12
Weakness classification (CWE)
References
- github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-5v8v-gw… (Third Party Advisory)
- github.com/neo4j-contrib/neo4j-apoc-procedures/commit/01e63ed2d187cd2a8aa1d78bf… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-23532?
- CVE-2022-23532 is a high-severity vulnerability in Neo4j Awesome Procedures On Cyper, classified under Path Traversal. CVSS score: 7.1/10. Published 2023-01-14.
- How severe is CVE-2022-23532?
- High severity. CVSS v3 base score is 7.1 out of 10.