Neo4j Cypher injection via Rust derive macros — full chain on HTB Sorcery

Short summary

HTB Sorcery demonstrates a three-CVE chain: JWT auth bypass via public key as HMAC secret, Cypher injection via unsanitized query concatenation allowing APOC exfiltration, and unsafe Rust derive macros emitting malformed queries. The combined attack achieves RCE as Neo4j's OS user from unauthenticated initial access. Graph databases need the same string-concatenation paranoia as SQL injection vectors.

• •JWT signed with public key enables unauthenticated admin access (CVE-2026-29000)
• •Unsanitized Cypher injection allows password hash exfiltration via APOC.load.json
• •Custom Rust derive macros can generate malformed Cypher under adversarial control
• •Full RCE achieved from initial recon through privilege escalation

Generated with AI, which can make mistakes.