Threats affecting pkg:cargo/surrealdb

SurrealDB versions prior to 3.1.0 contain a vulnerability where authenticated users with UPDATE permissions can read field values hidden by field-level SELECT permissions through error messages. This occurs because arithmetic operators and the extend function embed raw operand values in error messages, revealing sensitive data. A patch is available in version 3.1.0 and later that replaces raw operand values in errors with their type names, preventing information disclosure.

SurrealDB versions prior to 3.1.0 contain an authorization bypass vulnerability in the KILL statement used to terminate live query subscriptions. The implementation verifies database-level access but fails to confirm that the requesting user owns the live query being terminated. This allows any authenticated user with database-level access to terminate other users' live queries silently, disrupting real-time data subscriptions and breaking multi-tenant isolation. The vulnerability requires knowledge of the target live query UUID, which may be exposed through logs or shared dashboards. The issue has been patched in version 3.1.0 with an ownership verification check.

SurrealDB versions prior to 3.1.0 contain a vulnerability where authenticated users with select permission on a table can bypass select permissions on other tables reachable via graph edges or back-references. This allows reading records from those target tables despite their select permissions being set to NONE. The issue arises because certain graph traversal operations fetch records directly from storage without enforcing the target table's select permissions. The vulnerability affects confidentiality within the current database but does not impact namespace or database isolation. Versions 3.1.0 and later include a fix that enforces select permissions correctly during graph traversals.

SurrealDB versions prior to 3.1.0 contain a vulnerability where user-supplied expressions in SELECT and update-variant statements are evaluated before permission checks, allowing authenticated users to bypass table-level SELECT permissions and read full record contents. This flaw is limited to the current database and does not affect namespace or database isolation boundaries. A patch is available in version 3.1.0 and later that corrects the permission check order. Mitigations include disabling scripting functions to block the most direct exfiltration method and restricting query access for untrusted users.

SurrealDB versions prior to 3.1.0 contain a denial of service vulnerability in their JSON and value parser due to missing enforcement of recursion depth limits on nested JSON tokens. An unauthenticated attacker can exploit this by sending a deeply nested JSON payload to the WebSocket /rpc endpoint, causing server memory exhaustion and process crash. Versions 3.1.0 and later include a patch that enforces the recursion depth limit, mitigating this issue.

SurrealDB versions 3.1.0 through 3.1.4 contain a vulnerability where field-level SELECT permissions can be bypassed via graph-edge or back-reference traversals. Users with table-level SELECT permission can access field values hidden by field-level restrictions when records are accessed through these traversal methods. This issue does not allow unauthorized access to records outside the user's table-level permissions and does not affect root or record-owner sessions. The vulnerability is fixed in version 3.1.5 and later.