SurrealDB Server-Side Request Forgery via JWKS URL Port Bypass

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in SurrealDB versions 3.1.0 to 3.2.9. It allows database owners to bypass port-specific deny-net rules by using JWKS URLs that omit explicit ports 80 or 443. The system assumes default ports, enabling blind GET requests to restricted internal services.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for outbound GET requests to internal services on ports 80 or 443 that bypass deny-net rules. Check SurrealDB logs for JWKS URL fetches with implicit default ports. Use tools like tcpdump or Wireshark to inspect traffic from SurrealDB processes.

Useful 0 Not Useful 0

Impact Analysis

An attacker with database owner privileges could exploit this to send requests to internal services that should be blocked. This could lead to unauthorized access to sensitive data, internal network probing, or interaction with restricted endpoints on ports 80 or 443.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later to address the issue. Review and update deny-net rules to explicitly block all ports, including 80 and 443. Audit JWT and record access configurations for JWKS URLs to ensure no implicit default ports are used.

Useful 0 Not Useful 0