SurrealDB Authentication Bypass via USE Clause

Executive Summary

SurrealDB before 1.5.4 fails to validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate another user in a different database if a user record with the same identifier exists, allowing unauthorized actions if permissions rely on the $auth parameter.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 1.5.4. Run the command: surrealdb version. If the version is 1.5.3 or lower, the system is vulnerable. Additionally, review database configurations for user records with identical identifiers across databases.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker could access data or perform actions they shouldn't by impersonating another user in a different database. This is limited to users with matching record identifiers and requires the attacker to have an authenticated session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to personal or sensitive health data if permissions rely solely on the $auth parameter. If an attacker exploits this flaw to impersonate a user in a different database, they may gain access to protected information without proper authentication, violating data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 1.5.4 or later. If upgrading is not possible, ensure PERMISSIONS clauses verify the $scope parameter or use unique record identifiers across databases. Avoid using incremental or explicitly defined identifiers for users.

Useful 0 Not Useful 0