neo4j-apoc-procedures is vulnerable to path traversal

CVE-2022-23532

What is CVE-2022-23532?

A path traversal vulnerability exists in the APOC procedures of the Neo4j Graph database, particularly in the apoc.export.* procedures. This issue permits an unauthorized actor to escape from the intended directory structure when executing arbitrary queries. While files may be created, they cannot be overwritten. For exploitation, the attacker must have access to an authenticated Neo4j client or leverage a Cypher injection vulnerability present in an application. To mitigate the impact of this vulnerability, administrators should implement restrictions on the procedures permitted in their systems or disable local file access by setting 'apoc.export.file.enabled=false'.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References