Attack Chain

1. An attacker identifies a NornicDB instance running on a local network (LAN).
2. The attacker scans the network for open port 7687, the default Bolt port, on the target machine.
3. The attacker connects to the open Bolt port (7687) on the target NornicDB instance using nc -z 192.168.x.y 7687.
4. The attacker attempts to authenticate to the Bolt server using the default credentials admin:password.
5. Upon successful authentication, the attacker issues arbitrary Cypher queries to read, write, or delete nodes within the graph database.
6. The attacker exfiltrates sensitive data from the database using Cypher queries.
7. The attacker modifies or deletes critical data within the database, causing data integrity issues or service disruption.

Impact

The vulnerability allows unauthorized remote access to NornicDB instances with default configurations. Attackers can exploit this flaw to issue arbitrary Cypher queries, potentially leading to complete database compromise. If the NornicDB instance contains sensitive information, successful exploitation could result in data breaches, financial losses, and reputational damage. Users following the README and reasonably assuming that --address 127.0.0.1 (the documented default) binds both protocols to localhost are particularly at risk.

Recommendation

• Upgrade NornicDB to version 1.0.42-hotfix or later to patch the improper network binding vulnerability.
• Apply host-firewall rules (e.g., macOS pf) blocking non-loopback connections to port 7687 as a workaround until the upgrade can be performed, as suggested in the advisory.
• Deploy the Sigma rule Detect NornicDB Bolt Server Wildcard Binding to identify instances with exposed Bolt ports on all interfaces.