XML External Entity Vulnerability in Neo4j APOC Add-on Library

CVE-2023-23926

What is CVE-2023-23926?

The APOC add-on library for Neo4j has a vulnerability stemming from improper configuration of its XML parser in the apoc.import.graphml procedure. This security flaw permits the use of external entities, which can be leveraged to access local files, conduct HTTP requests, and potentially launch denial-of-service attacks. Exploiting this vulnerability could allow an attacker, possessing specific privileges, to read sensitive one-line files or disrupt service through malformed XML input. To mitigate risks, upgrading to version 5.5.0 or later is essential, or alternatively, implementing an allowed procedures list can provide a temporary safeguard.

References