Duplicate Advisory: SurrealDB server-takeover via SurrealQL injection on backup import

SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 fails to properly escape table and field names in the command-line export command. This allows an authenticated System User with OWNER or EDITOR roles to embed malicious SurrealQL code in table or field names. Upon import of the backup by a higher-privileged user, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the database instance. This vulnerability also exposes applications that allow user-defined tables or fields to a universal second-order SurrealQL injection, bypassing query parameter sanitization.

An attacker with OWNER or EDITOR roles can escalate privileges to root level by injecting malicious SurrealQL commands via crafted table or field names in backups. This leads to full server takeover of the SurrealDB instance. The vulnerability affects the integrity and confidentiality of the database and can compromise all stored data and operations.

A patch is available for this vulnerability. Users should upgrade SurrealDB to versions 2.0.5 or later, 2.1.5 or later, and 2.2.2 or later to remediate this issue. Applying these official fixes will prevent SurrealQL injection via backup import. No additional mitigation steps are required if the patch is applied.