Threat-Model a Graph Application Including Query Injection, Over-Privileged Procedures, Data Exfiltration, and Admin Paths

Learning outcomes

A secure AtlasMart deployment can still fail through composition: a parameterized endpoint is safe from value injection but lets the caller choose arbitrary labels; an APOC HTTP procedure has unrestricted network access; a backup directory is readable by a web-service account; a Community DB credential bypasses application tenant checks; or an admin recovery step temporarily disables authentication while the server remains remotely reachable. Threat modeling connects these paths before an attacker does.

Reproducible AtlasMart setup

$env:NEO4J_URI='bolt://127.0.0.1:7687'$env:NEO4J_USER='neo4j'$env:NEO4J_PASSWORD='atlasmart-course-2026'$env:NEO4J_DATABASE='neo4j'py -3 -m venv .venv.\.venv\Scripts\Activate.ps1python -m pip install --upgrade pippython -m pip install neo4j==6.3.0

CYPHER 25CREATE CONSTRAINT customer_id IF NOT EXISTSFOR (c:Customer) REQUIRE c.customerId IS UNIQUE;CREATE CONSTRAINT product_id IF NOT EXISTSFOR (p:Product) REQUIRE p.productId IS UNIQUE;CREATE CONSTRAINT order_id IF NOT EXISTSFOR (o:Order) REQUIRE o.orderId IS UNIQUE;MERGE (c:Customer {customerId:'C-1001'})SET c.name='Mina Rahimi', c.tier='GOLD', c.tenantId='TENANT-A'MERGE (p:Product {productId:'P-1001'})SET p.name='Trail Camera', p.category='Cameras', p.price=129.90MERGE (o:Order {orderId:'O-5001'})SET o.status='PAID', o.tenantId='TENANT-A', o.orderedAt=datetime('2026-09-08T16:30:00Z')MERGE (c)-[:PLACED]->(o)MERGE (o)-[r:CONTAINS]->(p)SET r.quantity=1, r.unitPrice=129.90;

These are course-only credentials and synthetic records. The fixture deliberately includes tenantId because authorization mistakes often appear when a graph traversal crosses a tenant boundary even though authentication succeeded.

1. Define assets and trust boundaries

2. Query injection: parameters solve values, not arbitrary syntax

def search(label, text, driver):    # WRONG: label and text both become query syntax.    query = f"MATCH (n:{label}) WHERE n.name CONTAINS '{text}' RETURN n"    return driver.execute_query(query, database_="neo4j")

ALLOWED_LABELS = {"Product", "Category"}def search(label, text, driver):    if label not in ALLOWED_LABELS:        raise ValueError("unsupported search domain")    query = f"""    CYPHER 25    MATCH (n:{label})    WHERE n.name CONTAINS $text    RETURN n.name AS name    ORDER BY name    LIMIT 50    """    return driver.execute_query(query, text=text, database_="neo4j")

Cypher parameters are the primary defense for values. When identifiers or query structure cannot be parameterized, do not “escape whatever the user sent”; choose from server-owned query templates/allowlists.

3. Tenant boundary must be before or inside graph expansion

CYPHER 25MATCH (o:Order {orderId:$orderId})-[:CONTAINS]->(p:Product)RETURN o.orderId, o.status, collect(p.productId) AS products;

CYPHER 25MATCH (o:Order {orderId:$orderId, tenantId:$tenantId})-[:CONTAINS]->(p:Product)RETURN o.orderId, o.status, collect(p.productId) AS products;

Application authorization must establish the caller’s tenant/subject from trusted identity context, not accept a tenant ID and blindly trust it. In Enterprise, graph/property-based privileges may add another DB-enforced layer; in Community the app predicate is critical because the DB user remains an implied admin.

4. Procedures/plugins can become exfiltration or privilege bridges

docker exec atlasmart-neo4j sh -lc '  grep -E "^[[:space:]]*dbms.security.procedures.(allowlist|unrestricted)"     "$NEO4J_HOME/conf/neo4j.conf" || true  ls -la /plugins 2>/dev/null || true' 

5. Safe negative-test matrix

6. Threat-model one request end to end

Internet/client  -> API gateway / TLS / authentication  -> application subject + tenant authorization  -> fixed repository method + parameterized Cypher  -> driver TLS + service credential  -> Neo4j authentication  -> Neo4j RBAC (Enterprise/Aura-capable tier) OR documented Community gap  -> graph traversal/property access  -> procedure/plugin/file/network boundary if invoked  -> bounded projection  -> audit/correlation evidence

Every arrow is a trust boundary with an owner. If a control is absent—such as Community DB RBAC—write the gap down and decide whether application controls plus deployment isolation are sufficient for the risk, or whether the tier must change.

7. Security acceptance checklist

8. Cleanup of course-only identities

DROP USER atlasmart_app IF EXISTS;// Enterprise-only cleanup if you created the optional RBAC lab objects:// DROP USER atlasmart_reader_user IF EXISTS;// DROP USER atlasmart_service IF EXISTS;// DROP ROLE atlasmart_reader IF EXISTS;// DROP ROLE atlasmart_order_writer IF EXISTS;// DROP ROLE atlasmart_visualizer IF EXISTS;

Production judgment

Summary and next step

Neo4j security is layered: identity, authorization, verified transport, secret lifecycle, safe query construction, extension governance, filesystem/admin boundaries and evidence. Chapter 16 can now introduce clustering and availability without treating replication as a security control or assuming a highly available cluster automatically has a least-privilege architecture.

Authoritative references

• Current Neo4j versions — Current server and 5.26 LTS release snapshot.
• Security checklist — Official baseline for deployment, transport, extensions, backup and filesystem security.
• Manage users — Native users, password handling, Community/Enterprise user-model distinctions.
• Role-based access control — Enterprise RBAC model and GRANT/DENY/REVOKE semantics.
• Read privileges — TRAVERSE, READ and MATCH graph privilege semantics.
• Write privileges — CREATE, DELETE, SET, MERGE and WRITE privilege semantics.
• SSL framework — Bolt/HTTPS TLS policies, certificate files, TLS levels and URI schemes.
• Procedure/function privileges — Execute and boosted-execution privilege boundaries.
• Python driver advanced connections — TLS/trust and rotating authentication token support in the maintained Python driver.
• Security log / logging — Log availability and Enterprise security/query-log boundaries.
• Password/user recovery — Safe auth-disable recovery sequence with network isolation.
• APOC security guidelines — APOC procedure security, file/network and unrestricted configuration considerations.