Amazon Neptune 1.4.7.1 Unauthorized Access Vulnerability Advisory

Amazon Neptune Engine Version 1.4.7.1 Vulnerability Summary Vulnerability Overview Vulnerability ID: CVE-2025-23646 Vulnerability Type: SQL Injection Affected Component: Amazon Neptune Engine Version 1.4.7.1 Vulnerability Description: - In Neptune Engine Version 1.4.7.1, there is an SQL injection vulnerability that allows attackers to bypass access controls by crafting malicious queries. - This vulnerability enables attackers to execute arbitrary SQL queries, potentially leading to data exfiltration, data tampering, or denial of service. - The scope of impact includes all instances using Neptune Engine Version 1.4.7.1. Scope of Impact Affected Versions: Amazon Neptune Engine Version 1.4.7.1 Affected Instances: All Neptune instances using this version Affected Functions: - Query execution - Data access control - Database security Remediation Upgrade Engine Version: - Upgrade the Neptune engine version from 1.4.7.1 to 1.4.7.2 or higher. - Upgrade Steps: 1. Log in to the AWS Management Console. 2. Navigate to the Neptune service. 3. Select the affected instance. 4. Click the "Modify" button. 5. In the "Engine Version" field, select version 1.4.7.2 or higher. 6. Click the "Apply Modifications" button. 7. Wait for the instance to complete its reboot. Manual Backup: - Before upgrading, it is recommended to manually back up the database to prevent data loss. - Backup Steps: 1. Log in to the AWS Management Console. 2. Navigate to the Neptune service. 3. Select the affected instance. 4. Click the "Create Snapshot" button. 5. Enter a snapshot name and click the "Create Snapshot" button. 6. Wait for the snapshot creation to complete. POC or Exploit Code No specific POC code or exploit code is included in the document. Additional Information Publication Date: 2025-09-18 Documentation Link: Amazon Neptune Engine Version 1.4.7.1 (2025-09-18) --- Note: Ensure that you upgrade the Neptune engine version promptly to remediate this vulnerability, and perform regular database backups to prevent data loss.

Goal Reached Thanks to every supporter — we hit 100%!

Amazon Neptune 1.4.7.1 Unauthorized Access Vulnerability Advisory