CVE-2025-66169
📋 TL;DR
This CVE describes a Cypher Injection vulnerability in Apache Camel's camel-neo4j component, allowing attackers to execute arbitrary Cypher queries against Neo4j databases. Affected users are those running Apache Camel versions 4.10.0-4.10.7, 4.14.0-4.14.2, or 4.15.0-4.16.x with the camel-neo4j component enabled.
💻 Affected Systems
- Apache Camel with camel-neo4j component
📦 What is this software?
Camel by Apache
Camel by Apache
Camel by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Neo4j database including data theft, data manipulation, or data destruction through arbitrary Cypher query execution.
Likely Case
Unauthorized data access or modification in Neo4j databases, potentially exposing sensitive information or corrupting data integrity.
If Mitigated
Limited impact if proper input validation and parameterized queries are already implemented, though the underlying vulnerability remains.
🎯 Exploit Status
Exploitation requires the ability to inject malicious Cypher queries through camel-neo4j endpoints. Similar to SQL injection but for Neo4j's Cypher query language.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.10.8 (for 4.10.x LTS), 4.14.3 (for 4.14.x LTS), 4.17.0 (for 4.15.0+)
Vendor Advisory: https://camel.apache.org/security/CVE-2025-66169.html
Restart Required: Yes
Instructions:
1. Identify your Apache Camel version. 2. Upgrade to the appropriate patched version: 4.10.8 for 4.10.x, 4.14.3 for 4.14.x, or 4.17.0 for 4.15.0+. 3. Restart your Camel applications. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable camel-neo4j component
allTemporarily disable the vulnerable camel-neo4j component if not essential
Remove or comment out camel-neo4j dependencies in your pom.xml or build.gradle
Remove camel-neo4j routes from your Camel configurations
Implement input validation
allAdd strict input validation for all parameters passed to camel-neo4j endpoints
Implement parameter validation in your Camel routes before passing to camel-neo4j
Use parameterized queries instead of string concatenation
🧯 If You Can't Patch
- Implement network segmentation to isolate Neo4j databases from untrusted networks
- Enable strict input validation and use parameterized queries in all camel-neo4j interactions
🔍 How to Verify
Check if Vulnerable:
Check your Apache Camel version and verify if camel-neo4j component is in use. Versions 4.10.0-4.10.7, 4.14.0-4.14.2, or 4.15.0-4.16.x with camel-neo4j are vulnerable.Check Version:
Check CamelContext version in logs or use: System.out.println(org.apache.camel.CamelContext.getVersion())Verify Fix Applied:
Verify Apache Camel version is 4.10.8+, 4.14.3+, or 4.17.0+ and camel-neo4j component is updated.📡 Detection & Monitoring
Log Indicators:
- Unusual Cypher query patterns in Neo4j logs
- Errors from malformed Cypher queries in Camel logs
- Unexpected database access patterns
Network Indicators:
- Unusual traffic to Neo4j database ports from Camel applications
- Suspicious query patterns in network traffic
SIEM Query:
Search for: 'camel-neo4j' AND ('error' OR 'exception') AND ('cypher' OR 'query') in application logs