Skip to main content
protocols.pageprotocols.page
7474

Port 7474 – Neo4j HTTP

TCP

Port 7474 is the Neo4j graph database HTTP API and Browser interface port. The Neo4j Browser on port 7474 provides a visual interface for Cypher queries and graph exploration. Default installations allow unauthenticated access – exposed instances leak entire graph databases. Set dbms.security.auth_enabled=true immediately.

Port Number

7474

Protocol

TCP

Service

Neo4j Browser / HTTP API

Range

IANA Registered (1024–49151)

Description

Neo4j on port 7474 serves both the REST HTTP API and the Neo4j Browser web interface. The Browser provides an interactive environment for writing Cypher queries, visualizing graph relationships, and exploring database schema. The HTTP API enables programmatic access for applications. Neo4j Community Edition historically shipped with authentication disabled (changed in 4.x). Exposed Neo4j instances on port 7474 have been found containing sensitive data – social graphs, authorization models, infrastructure maps, and fraud detection networks. Always enable authentication, change the default neo4j/neo4j credentials on first login, bind to localhost for the HTTP API, and use port 7687 (Bolt protocol with TLS) for application connections.

Security risks

  • 1CVE-2021-34371 (CVSS 9.8): Neo4j ShellServer RCE – unauthenticated remote code execution via Java RMI on Neo4j versions with shell server enabled. Attacker sends crafted RMI objects to execute arbitrary code as the neo4j process. Fixed in 3.5.28/4.2.6
  • 2Default no-auth in Community Edition (pre-4.x): Neo4j Community historically shipped with dbms.security.auth_enabled=false. Any client connecting to port 7474 has full read/write access to the entire graph including CALL dbms.changePassword and CREATE USER
  • 3Cypher injection: unsanitized user input in Cypher queries allows graph traversal beyond intended scope. Example: WHERE n.name = '" + input + "' enables UNION-based injection to extract any node/relationship. Use parameterized queries ($param syntax)
  • 4Full graph exfiltration via APOC: the APOC library exposes apoc.export.json.all() which dumps the entire database in one call. Combined with no auth, attackers exfiltrate complete knowledge graphs in seconds
  • 5Browser console on 7474 executes arbitrary Cypher: if port 7474 is reachable, attackers use the built-in Neo4j Browser to run MATCH (n) DETACH DELETE n (destroys all data) or CALL dbms.listConfig() (reveals all settings)

Firewall guidance

Bind port 7474 to localhost only (dbms.connector.http.listen_address=127.0.0.1:7474). Applications should connect via Bolt (port 7687) with TLS, not HTTP. For admin access to Neo4j Browser, use SSH tunneling or VPN. In production, disable the HTTP connector entirely if only Bolt is needed: dbms.connector.http.enabled=false. Enable auth: dbms.security.auth_enabled=true (set on first launch, cannot be disabled without data loss in Enterprise).

Diagnosis commands

Check Neo4j version (determines auth defaults and CVE exposure)

shell
curl -s http://localhost:7474/ | jq .neo4j_version

Test if default credentials work (should fail after initial setup)

shell
curl -s -u neo4j:neo4j http://localhost:7474/db/neo4j/tx/commit -d '{"statements":[{"statement":"RETURN 1"}]}' -H 'Content-Type: application/json'

Verify bind address (should be 127.0.0.1, not 0.0.0.0)

shell
ss -tlnp | grep 7474

List database users and auth status

shell
curl -s http://localhost:7474/db/system/tx/commit -u neo4j:pass -H 'Content-Type: application/json' -d '{"statements":[{"statement":"SHOW USERS"}]}'

Usage examples

Port 7474 – Neo4j HTTP
shell
curl http://localhost:7474/db/neo4j/tx/commit -d '{"statements":[{"statement":"MATCH (n) RETURN count(n)"}]}'
neo4j-admin set-initial-password
cypher-shell -a bolt://localhost:7687

Common services on this port

Neo4j CommunityNeo4j EnterpriseNeo4j Aura (managed)Neo4j Bloom (visualization)Graphene / GraphQL wrappers

Related ports

7687

Neo4j Bolt protocol (application drivers)

7473

Neo4j HTTPS (encrypted Browser/API)

6362

Neo4j backup port

5000

Neo4j cluster discovery (Core)

History

Neo4j was created by Neo4j Inc (formerly Neo Technology) in 2007, making it the oldest graph database in active development. Port 7474 was chosen for the HTTP API. The Neo4j Browser (a React app served on 7474) was added in version 2.0 (2013). Bolt protocol (port 7687) was introduced in Neo4j 3.0 (2016) as a more efficient binary alternative to HTTP. Neo4j 4.0 (2020) made authentication mandatory by default in Enterprise Edition.

FAQ

Should I use port 7474 or 7687 for my application?

Always use 7687 (Bolt) for applications. It is binary (faster), supports connection pooling, transactions, and streaming results. Port 7474 (HTTP) is for the Browser UI and ad-hoc queries during development. In production, disable 7474 entirely or bind to localhost, and route all application traffic through Bolt with TLS (neo4j+s:// URI scheme).

How do I secure Neo4j after installation?

1. Enable auth: dbms.security.auth_enabled=true in neo4j.conf. 2. Change default password on first connect: ALTER CURRENT USER SET PASSWORD FROM 'neo4j' TO 'strong-pass'. 3. Bind HTTP to localhost: dbms.connector.http.listen_address=127.0.0.1:7474. 4. Enable Bolt TLS: dbms.connector.bolt.tls_level=REQUIRED with proper certificates. 5. Disable APOC export procedures if not needed. 6. Use RBAC roles (Enterprise) to restrict Cypher operations per user.