Duplicate Advisory: SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB prior to version 2.2.2 fails to validate HTTP redirects within its http functions. Authenticated users can exploit this by hosting a public server that redirects to IP addresses blocked by deny-net flags. This bypass enables server-side request forgery (SSRF) attacks, allowing attackers to access internal network endpoints and potentially retrieve sensitive data. The vulnerability is tracked as CVE-2025-71398 and is associated with CWE-918 (Server-Side Request Forgery). The advisory for this vulnerability has been withdrawn as it duplicates GHSA-5q9x-554g-9jgg.

An authenticated attacker can bypass network restrictions intended to block access to certain IP addresses by leveraging unvalidated HTTP redirects. This can lead to SSRF attacks, allowing the attacker to make requests to internal or otherwise restricted network resources. The impact includes potential exposure of sensitive information and partial disruption of service. The CVSS score of 7.6 reflects high confidentiality impact, low integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory GHSA-5q9x-554g-9jgg for current remediation guidance. Since the advisory is withdrawn as a duplicate, refer to the original GHSA advisory for official fixes or workarounds. Until patched, restrict authenticated user capabilities to invoke http functions or monitor for suspicious redirect usage if possible.