SurrealDB vulnerabilities

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

SurrealDB before versions 2.2.6, 2.3.6, 2.1.8, and 3.0.0-alpha.7 fails to validate DNS-resolved hostnames against deny-net restrictions in http::* functions. An authenticated user can use a hostname that resolves to a blocked IP, bypassing access controls.

SurrealDB before version 1.1.0 fails to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.

Vulnerability in SurrealDB before version 1.1.0. Improper parsing of ID, DB, and NS headers in HTTP REST API requests with special characters. Unauthenticated attacker can send crafted HTTP requests causing an uncaught exception that crashes the server.

Vulnerability in SurrealDB before version 2.0.4. Field permissions are not enforced during SELECT, UPDATE, and DELETE operations. An authenticated user can access field values they lack permission for using techniques like SELECT VALUE, field aliasing, functions, WHERE clause, RETURN BEFORE, and SET.

SurrealDB before version 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs.

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

SurrealDB before version 1.2.1 contains an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic and crash the server.

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

Vulnerability in SurrealDB before version 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) in the RPC API. An unauthenticated attacker can supply a binary object with a subquery in place of credentials, leading to execution of the subquery in the context of the database owner with editor role.

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

SurrealDB before version 2.1.0 has a denial of service vulnerability in the sorting mechanism when using ORDER BY rand(). Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.

SurrealDB before version 2.1.0 contains a denial of service vulnerability in role conversion. A privileged user can define users with nonexistent roles, and signing in with such a user triggers an uncaught panic, crashing the server.

Vulnerability in SurrealDB before version 2.1.0 in the rand::time() function panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to trigger server panics and cause denial of service.

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

SurrealDB before version 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations without explicit permissions. Attackers with database access or unauthenticated users on public instances can perform unrestricted operations on unprotected tables.

A vulnerability in SurrealDB before version 3.1.5 fails to apply field-level SELECT permissions to ORDER BY clauses. This allows authenticated users to leak the relative ordering of restricted field values.

In SurrealDB prior to version 3.1.0, when a node is deleted, the Document::purge_edges function automatically removes associated graph edges, bypassing the PERMISSIONS FOR delete and PERMISSIONS FOR select clauses defined on the edge table. This occurs because the operation runs with permissions disabled (opt.clone().with_perms(false)).