CVE-2024-34517
📋 TL;DR
This vulnerability in Neo4j's Cypher component allows attackers with admin access to bypass IMMUTABLE privilege restrictions in certain situations. It affects Neo4j versions 5.0.0 through 5.18. The issue enables privilege escalation where immutable data protections can be circumvented.
💻 Affected Systems
- Neo4j Graph Database
📦 What is this software?
Neo4j by Neo4j
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise where immutable data protections are bypassed, allowing unauthorized modification of supposedly protected data.
Likely Case
Privilege escalation where admin users can modify data that should be protected by IMMUTABLE privileges, potentially violating data integrity guarantees.
If Mitigated
Limited impact if proper access controls and monitoring are in place to detect unusual admin activity.
🎯 Exploit Status
Exploitation requires existing admin-level access to the Neo4j instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.19.0 and later
Vendor Advisory: https://neo4j.com/security/cve-2024-34517/
Restart Required: Yes
Instructions:
1. Download Neo4j 5.19.0 or later from official sources. 2. Stop the Neo4j service. 3. Backup your database. 4. Install the updated version. 5. Restart the Neo4j service.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit admin privileges to only essential personnel and implement strict access controls.
Monitor Admin Activity
allImplement comprehensive logging and monitoring of admin user activities, especially privilege-related operations.
🧯 If You Can't Patch
- Implement strict principle of least privilege for admin accounts
- Enable detailed audit logging for all admin operations and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Neo4j version using 'neo4j version' command or by examining server logs for version information.Check Version:
neo4j versionVerify Fix Applied:
Verify version is 5.19.0 or later using 'neo4j version' command and test that IMMUTABLE privilege restrictions are properly enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual admin privilege escalation attempts
- Modification attempts on data with IMMUTABLE privileges
- Cypher queries attempting to bypass privilege restrictions
Network Indicators:
- Unusual patterns of admin-level database queries
- Multiple privilege modification attempts in short timeframes
SIEM Query:
source="neo4j" AND (event_type="privilege_escalation" OR event_type="immutable_violation" OR query CONTAINS "IMMUTABLE")🔗 References
- https://github.com/advisories/GHSA-p343-9qwp-pqxv
- https://github.com/neo4j/neo4j/wiki/Neo4j-5-changelog#cypher
- https://neo4j.com/security/cve-2024-34517/
- https://trust.neo4j.com
- https://github.com/advisories/GHSA-p343-9qwp-pqxv
- https://github.com/neo4j/neo4j/wiki/Neo4j-5-changelog#cypher
- https://neo4j.com/security/cve-2024-34517/
- https://trust.neo4j.com
