surrealdb vulnerabilities and threats

SurrealDB versions prior to 3.3.0 have an authorization bypass vulnerability that allows users with table-level write permissions to access fields restricted by SELECT permissions. This is achieved by exploiting JSON Patch operations to copy or move hidden fields into readable locations or by using test mismatch errors to disclose sensitive information.

SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that allows users to read fields protected by field-level SELECT permissions. This occurs through LIVE SELECT projections where restricted fields can be accessed via the unreduced $after or $before parameters under an alias during CREATE, UPDATE, and DELETE notifications. The issue is fixed in version 3.3.0.

SurrealDB versions before 3.2.0 have a denial of service vulnerability in the SurrealML header parser. Authenticated users with Owner role can crash the server by uploading a malformed .surml file to the /ml/import endpoint. The vulnerability arises from improper input validation, where non-numeric input-dimensions or malformed header fields cause unchecked unwrap calls that panic and abort the server process, resulting in denial of service.

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

SurrealDB versions before 1.1.0 have a vulnerability where recursion depth limits are not enforced when parsing nested SurrealQL statements. This allows authorized attackers to submit queries with excessive nesting, causing a stack overflow and crashing the server.

SurrealDB versions before 1.1.1 contain a vulnerability where improper validation of custom parameters and functions at root or namespace levels can cause the server to panic. Authorized clients can exploit this flaw to crash the server, leading to a denial of service condition.

SurrealDB versions before 1.1.0 contain a vulnerability where the server fails to properly parse certain HTTP REST API headers with special characters. This flaw allows unauthenticated attackers to send crafted requests that cause an uncaught exception, crashing the server and resulting in a denial of service.

SurrealDB versions before 2.0.4 have an improper authorization vulnerability that allows authorized users to bypass field-level permissions during SELECT, UPDATE, and DELETE operations. Attackers can use various query techniques to access protected field values without having explicit SELECT permissions. This flaw affects version 0 and is rated high severity with a CVSS score of 7.1.

SurrealDB versions before 1.1.1 have a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. This flaw allows attackers with scripting privileges to supply malicious format string sequences in error inputs, potentially leading to arbitrary memory reads or code execution with the privileges of the SurrealDB process.

SurrealDB versions before 1.2.0 have an uncaught exception vulnerability in the query executor. This flaw occurs when authorized clients send queries that call nonexistent built-in functions, causing the server to panic and crash. The vulnerability allows denial of service by crashing the database server.

SurrealDB versions before 1.2.1 have a vulnerability where malformed queries containing errors on line terminator characters cause an uncaught exception in the span rendering code. This triggers a server panic and crash, resulting in denial of service. The issue affects authorized clients who can submit such malformed queries.

SurrealDB versions before 1.5.4 contain an authentication validation flaw. When a user switches databases using the USE clause or use method, the system fails to properly validate authentication. This allows an authenticated user to impersonate another user in a different database if a user record with the same identifier exists. Unauthorized actions can occur if permissions are based solely on the $auth parameter.

SurrealDB versions before 1.5.5 and 2.0.0-beta versions before 2.0.0-beta.3 contain a vulnerability where the RPC API's signin and signup operations accept arbitrary objects without proper recursive validation. This allows an unauthenticated attacker to inject a binary-encoded subquery that executes with editor-level privileges, enabling modification of non-IAM resources. The attacker cannot view query results directly or affect IAM resources, which require higher privileges.