SurrealDB Recursion Bypass via JavaScript Query Chaining

Executive Summary

This is a memory exhaustion vulnerability in SurrealDB versions before 2.2.2 when scripting is enabled. It occurs when native functions contain embedded JavaScript that issues new queries, bypassing recursion limits. This triggers infinite recursion, consuming server memory until the system crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if SurrealDB is running with scripting enabled using --allow-scripting, --allow-all, or environment variables like SURREAL_CAPS_ALLOW_SCRIPT. Verify the version with 'surreal version' or check the running process. Monitor for high memory usage or server crashes during query execution.

Useful 0 Not Useful 0

Impact Analysis

Authenticated attackers could exploit this to perform a denial-of-service attack, crashing the SurrealDB server by exhausting its memory. This would disrupt database operations and make the system unavailable to legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by enabling denial-of-service attacks through memory exhaustion. While it does not directly violate GDPR or HIPAA, it could lead to non-compliance if the affected system is used to process or store regulated data. For example, GDPR requires appropriate security measures to ensure data availability and integrity, and a DoS condition could disrupt access to personal data. Similarly, HIPAA mandates safeguards against unauthorized access or disruptions that could compromise protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SurrealDB to versions 2.0.5, 2.1.5, or 2.2.2 or later. Alternatively, disable scripting by starting SurrealDB with --deny-scripting or setting SURREAL_CAPS_DENY_SCRIPT. Restrict authenticated user access to prevent exploitation until patched.

Useful 0 Not Useful 0