SurrealDB Field Permission Bypass Leading to Data Leakage

Executive Summary

CVE-2024-58367 is an improper authorization vulnerability in SurrealDB versions before 2.0.4. It allows authorized users to access unauthorized field values during SELECT, UPDATE, and DELETE operations. Attackers can exploit techniques like SELECT VALUE, field aliasing, function arguments, WHERE clauses, RETURN BEFORE clauses, and SET clause references to leak protected data despite lacking proper permissions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking SurrealDB versions and reviewing query logs for unauthorized field access attempts. Use commands like 'surreal version' to verify if your version is below 2.0.4. Monitor logs for suspicious SELECT VALUE, field aliasing, or function argument usage in queries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data exposure. Attackers with limited access may infer or retrieve restricted field values or record contents through side channels or function calls. It particularly affects systems relying on field-level permissions, potentially compromising sensitive information in backend-as-a-service setups.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to protected data. Organizations using SurrealDB versions before 2.0.4 may face legal and regulatory penalties due to improper data access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SurrealDB to version 2.0.4 or later. If upgrading is not possible, restrict access at the table level or disable field-level permissions entirely. Avoid relying on field permissions until patched.

Useful 0 Not Useful 0