-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.neo4j.procedure:apoc | maven | < 4.3.0.12 | 4.3.0.12 |
| org.neo4j.procedure:apoc | maven | >= 4.4.0.0, < 4.4.0.12 | 4.4.0.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation in FileUtils methods. The commit shows critical fixes in FileUtils.java: 1) Added URI normalization to prevent encoded traversal sequences, 2) Replaced Path.normalize() with getCanonicalFile() to resolve true paths. These functions were used by export procedures (like apoc.export.csv.query) to validate file paths. The ExportCSV class's export logic directly interacts with these vulnerable path handling functions, making it the exploitation vector. The test cases in ExportCoreSecurityTest confirm that apoc.export.* procedures were vulnerable to crafted paths.