Neo4j is a graph database queried with Cypher, and Cypher is injectable for the same reason SQL is: when application code concatenates user input into a query instead of binding parameters ($param), the input is parsed as query syntax. An attacker who reaches a string-built MATCH or WHERE can rewrite patterns and predicates, break out of a string literal, and append further clauses with WITH, MATCH, CALL, and comments (//, /* */).
Because Cypher traverses a single property graph with no table boundaries, injection crosses labels freely: one injected MATCH (n) RETURN n can enumerate every node, label, property, and relationship. Where the apoc procedure library is installed, CALL injection extends reach to SSRF, outbound exfiltration, and command execution. When no rows are reflected, boolean and time-based inference recover data blindly.
This subtree covers the core injection mechanics, cross-label extraction, APOC procedure abuse, and blind inference.
Pages#
- APOC procedure abuse: Reaching APOC procedures via CALL injection turns a Cypher flaw into SSRF, outbound exfiltration, file access, and arbitrary graph writes on Neo4j.
- Blind injection: Recover data through a Neo4j Cypher injection that returns no rows, using conditional patterns and apoc.util.sleep() for boolean and time-based inference.
- Cypher injection: Concatenating user input into MATCH/WHERE clauses lets an attacker escape string literals, flip predicates, and chain Cypher clauses against Neo4j.
- Data extraction: Cross-label extraction through injected UNION, WITH, and MATCH (n) RETURN n clauses, plus schema enumeration with db.labels() and db.schema in Neo4j.
Tools#
- cypher-shell: the native Cypher shell for testing payloads against a database.
- Burp Suite: intercept and tamper with Cypher-backed web requests.