5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66169

CVE-2025-66169: Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component

Cypher Injection vulnerability in Apache Camel camel-neo4j component.

This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0

Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66169

CVE-2025-66169:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.camel:camel-neo4j	maven	>= 4.10.0, < 4.10.8	4.10.8
org.apache.camel:camel-neo4j	maven	>= 4.14.0, < 4.14.3	4.14.3
org.apache.camel:camel-neo4j	maven	>= 4.15.0, < 4.17.0	4.17.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the camel-neo4j component's Neo4jProducer class, where Cypher queries were constructed by concatenating user-controlled input directly into query strings. This affects node creation, retrieval, and deletion operations.

The analysis of the provided patches (66715d3, 723e2cd, e46c4c0) reveals that the methods createNode, retrieveNodes, and deleteNode were all vulnerable. In each case, input from either the message body or the MATCH_PROPERTIES message header was formatted directly into the Cypher query string.

For example, in the createNode method, the message body, if it was a string, was directly appended to the CREATE statement. Similarly, retrieveNodes and deleteNode used a matchQuery variable, derived from a message header, to build the MATCH clause of their respective queries.

This vulnerability allows an attacker to perform a Cypher injection attack by crafting a malicious message body or header. The exploit could lead to unauthorized data access, modification, or deletion.

The patches fix this vulnerability by consistently using parameterized queries. Instead of string concatenation, the user input is now parsed (e.g., from a JSON string to a Map) and passed to the Neo4j driver as parameters. This ensures a strict separation between the query's logic and the data being processed, which is the standard defense against injection attacks.

Vulnerable functions

org.apache.camel.component.neo4j.Neo4jProducer.createNode

components/camel-ai/camel-neo4j/src/main/java/org/apache/camel/component/neo4j/Neo4jProducer.java

The `createNode` function was vulnerable to Cypher injection because it directly incorporated a user-provided string from the message body into a Cypher query using `String.format`. This allowed an attacker to inject arbitrary Cypher code. The patch mitigates this by parsing the string body as JSON and using parameterized queries, which separates the query logic from the data.

org.apache.camel.component.neo4j.Neo4jProducer.retrieveNodes

components/camel-ai/camel-neo4j/src/main/java/org/apache/camel/component/neo4j/Neo4jProducer.java

The `retrieveNodes` function was vulnerable to Cypher injection. It constructed a Cypher query by directly embedding the `MATCH_PROPERTIES` header value into the query string. This allowed an attacker to control the `MATCH` clause and inject arbitrary Cypher. The fix replaces this with logic that parses the properties and builds a safe, parameterized `WHERE` clause.

org.apache.camel.component.neo4j.Neo4jProducer.deleteNode

components/camel-ai/camel-neo4j/src/main/java/org/apache/camel/component/neo4j/Neo4jProducer.java

The `deleteNode` function was vulnerable to Cypher injection because it used the `MATCH_PROPERTIES` header to dynamically construct a Cypher query string. An attacker could provide a malicious header to alter the query and delete unintended data. The patch remediates this by parsing the header content and using it to build a parameterized query, preventing injection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.