SurrealDB HTTP REST API Header Parsing Flaw Leads to Server Crash

Executive Summary

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests when they contain special characters. This causes an uncaught exception that crashes the server, leading to a denial of service (DoS) attack. Unauthenticated attackers can exploit this by sending crafted HTTP requests with malformed header values.

Useful 0 Not Useful 0

Detection Guidance

Monitor SurrealDB server logs for crashes or uncaught exceptions during HTTP requests. Check for malformed header values in ID, DB, or NS fields. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP headers for suspicious patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to crash the SurrealDB server by sending malicious HTTP requests. The impact is a denial of service, making the database unavailable for legitimate users. The server must be manually restarted or configured to auto-restart after a crash.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the SurrealDB server, which could lead to prolonged downtime and potential data unavailability. For GDPR, this may impact the availability of personal data processing systems, potentially violating Article 32 requirements for resilience and availability. For HIPAA, it could disrupt access to protected health information, affecting the integrity and availability of electronic protected health information (ePHI) as required by the Security Rule.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 1.1.0 or later immediately. Restrict network access to the HTTP REST API endpoint. Implement auto-restart mechanisms for the SurrealDB process to recover from crashes. Consider disabling the API if not required.

Useful 0 Not Useful 0