CVE Vulnerability Catalog

A vulnerability was found in GoClaw up to version 3.13.2 in the isSafeBin function of the file internal/tools/exec_approval.go. The issue leads to improper authorization, allowing remote attacks. The exploit is publicly available and may be used.

A vulnerability was found in GoClaw up to version 3.13.3-beta.3 in the matchesAllowlist/extractBin functions of internal/tools/exec_approval.go. Input manipulation can lead to incorrectly-resolved names, enabling remote attacks. The exploit has been publicly disclosed and may be used.

A vulnerability in the WebSocket Approval Endpoint component of GoClaw up to version 3.13.2 involves incorrect authorization in the RequestApproval function. The attack can be performed remotely and the exploit has been made public.

Vulnerability in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2. Authenticated users with OWNER or EDITOR permissions can define database functions with nested FOR loops, potentially exhausting CPU and rendering the server unresponsive.

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when scripting is explicitly enabled. An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

Memory exhaustion vulnerability in SurrealDB before version 2.2.2 in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory, causing denial of service.

Vulnerability in SurrealDB before version 2.2.2 in the DEFINE ANALYZER statement allows authenticated users to read arbitrary local files. Attackers with root, namespace, or database privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

SurrealDB before version 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

SurrealDB before version 1.1.0 fails to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.

Vulnerability in SurrealDB before version 2.0.4. Field permissions are not enforced during SELECT, UPDATE, and DELETE operations. An authenticated user can access field values they lack permission for using techniques like SELECT VALUE, field aliasing, functions, WHERE clause, RETURN BEFORE, and SET.

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

SurrealDB before version 1.2.1 contains an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic and crash the server.

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

SurrealDB before version 2.1.0 has a denial of service vulnerability in the sorting mechanism when using ORDER BY rand(). Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.

SurrealDB before version 2.1.0 contains a denial of service vulnerability in role conversion. A privileged user can define users with nonexistent roles, and signing in with such a user triggers an uncaught panic, crashing the server.

Vulnerability in SurrealDB before version 2.1.0 in the rand::time() function panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to trigger server panics and cause denial of service.

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.