Skip to content

Access Control: Neo4j Authentication Disabled

Identifier: neo4j_auth_disabled

Scanner Support

GraphQL Scanner REST Scanner WebApp Scanner ASM Scanner Automated Pentest

Description

Neo4j instances with authentication disabled can allow unauthenticated users to query or modify graph data.

How we test: We attempt a benign Neo4j query without credentials and report the issue when unauthenticated access is accepted.

Configuration

Example

Example configuration:

---
security_tests:
  neo4j_auth_disabled:
    skip: false

Reference

skip

Type: boolean

Skip the test if true.