Improper or lack of sanitization of user-supplied inputs when constructing Cypher queries or Cypher fragments for the graph databases can allow an attacker to subvert the original query.

These attacks are made possible by incomplete or missing escaping of characters when constructing the Cypher query. Only Search collectors (using their configured system account identity) can trigger the injections on the aggregator via the HTTP POST message to the Hub's API endpoint. The aggregator component is deployed on the Hub but collectors are present on managed clusters (under the "search addon" designation).

Cypher requests are emitted using the GRAPH.QUERY redis command. This command allows for writing. Writing is superfluous for the search API and due to the structure of cypher requests any injections can be made to insert or alter any nodes and properties.