Langroid Neo4jChatAgent Cypher Query Injection Vulnerability Allowing Data Manipulation and Potential Remote Code Execution

A vulnerability in Langroid's Neo4jChatAgent prior to version 0.65.5 allows for prompt-injection attacks that can manipulate LLM-generated Cypher queries. These unvalidated queries are sent directly to the Neo4j database driver, enabling an attacker to read or delete all graph data. Furthermore, if certain procedures are enabled on the database, this could lead to unauthorized access to the filesystem, network, or operating system, depending on the configuration. This issue mirrors a similar vulnerability in the SQLChatAgent, which has been addressed in a previous update.

Impact

Exploitation of this vulnerability allows for unauthorized reading and deletion of graph data. Additionally, if certain database procedures are enabled, it could result in remote code execution or access to the filesystem or operating system.

Reproduction

The vulnerability can be reproduced by using the Neo4jChatAgent to execute Cypher queries. The agent will accept LLM-generated queries that have been injected with prompts, bypassing any validation. This can be done by influencing the agent's prompt directly or through content it retrieves via retrieval-augmented generation (RAG). Once the injected query is executed, it can manipulate graph data or, if the right database procedures are enabled, access the filesystem or execute OS commands.

Remediation

Users can upgrade to Langroid version 0.65.5, which includes a fix for this vulnerability by adding a validation process for Cypher queries and an opt-out gate for dangerous operations. It is recommended to run the agent with a least-privilege database role.