AI analysis
Apache Syncope contains a Cypher injection flaw (classified CWE-89) in its optional Neo4j graph database persistence layer, triggered when processing certain FIQL (Feed Item Query Language) search conditions. Because FIQL is used across Syncope's REST API and administrative console for searching users, groups, and any other objects, an attacker able to submit crafted search queries could inject arbitrary Cypher fragments into the underlying query, potentially reading, altering, or deleting identity data stored in the Neo4j graph. Only deployments using the Neo4j persistence backend are vulnerable; Syncope instances on JDBC backends (the more common configuration) are not directly affected by this specific flaw. The issue affects the 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.7, and 4.1.0-M0–4.1.2 release lines, with fixes available in 4.0.8 and 4.1.3. There is no known public proof of concept, CVSS score is not yet assigned, and no in-the-wild exploitation has been reported.
What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 immediately if you use the Neo4j persistence layer; users on the 3.0.x line must move to 4.0.8+ since no fixed 3.0.x release was issued. If immediate upgrade is not possible, restrict access to the Syncope REST API and console search endpoints (especially any anonymous-search capability) and audit logs for unusual FIQL query patterns against Neo4j-backed searches. Deployments on JDBC persistence are not affected by this specific issue but should still plan to upgrade during normal maintenance.
Affected
| Apache Syncope | 3.0.0-M0 through 3.0.16 |
| Apache Syncope | 4.0.0-M0 through 4.0.7 |
| Apache Syncope | 4.1.0-M0 through 4.1.2 |
Estimated exposure
nichelikely tens to low hundreds of self-hosted deployments worldwide (no public install counts; Neo4j is an optional, non-default persistence backend) — Apache Syncope is a niche open-source enterprise identity management platform with no published adoption metrics, and the vulnerable Neo4j backend is an optional alternative to the standard JDBC persistence layer, so only a fraction of an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.