Cypher injection in Neo4j, from LOAD CSV to AWS credentials

Little Bobby Tables has grown up, and now he’s playing with graphs. The article provides an overview of the different attacks observed on graph databases. Noy Pearl’s talk on Cypher injection had already shown blind exfiltration through LOAD CSV, a clause Neo4j cannot switch off the way it can disable functions. Pearl found no way to get the IMDSv2 session token into a LOAD CSV request, while Varonis uses APOC’s HTTP procedures to walk through the token flow and pull AWS credentials anyway.