neo4j-apoc-procedures is vulnerable to path traversal

CVE-2022-23532

What is CVE-2022-23532?

A path traversal vulnerability exists in the APOC procedures of the Neo4j Graph database, particularly in the apoc.export.* procedures. This issue permits an unauthorized actor to escape from the intended directory structure when executing arbitrary queries. While files may be created, they cannot be overwritten. For exploitation, the attacker must have access to an authenticated Neo4j client or leverage a Cypher injection vulnerability present in an application. To mitigate the impact of this vulnerability, administrators should implement restrictions on the procedures permitted in their systems or disable local file access by setting 'apoc.export.file.enabled=false'.

References