SurrealDB Default Table Permissions Privilege Escalation

Executive Summary

SurrealDB before version 1.0.1 sets default table permissions to FULL instead of NONE. This allows unauthorized users with database access or those on publicly exposed instances to perform SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. The issue is related to incorrect default permissions and could enable attackers to manipulate data within their authorization scope.

Useful 0 Not Useful 0

Detection Guidance

Check SurrealDB version with: surreal version. If version is below 1.0.1, the system is vulnerable. Inspect table permissions using: INFO FOR DB; look for tables with FULL permissions. Check for publicly exposed instances by reviewing network configurations and API endpoints.

Useful 0 Not Useful 0

Impact Analysis

Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables. This includes reading, modifying, or deleting data, potentially leading to data breaches, data loss, or unauthorized data manipulation. Systems with guest access via HTTP REST or WebSocket APIs are particularly vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data. It risks exposing personal or protected health information, violating data protection requirements for confidentiality, integrity, and availability of data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 1.0.1 or later immediately. If upgrading is not possible, explicitly set table permissions to NONE using the PERMISSIONS clause. Disable guest access if not required. Restrict network exposure of SurrealDB instances to trusted networks only.

Useful 0 Not Useful 0