SurrealDB SSRF via JWKS Fetcher Before 3.2.0

Executive Summary

SurrealDB before version 3.2.0 has a Server-Side Request Forgery (SSRF) vulnerability in its JWKS fetcher. The system only checks if the hostname in a JWKS URL is allow-listed but does not verify the resolved IP address. An attacker with Owner role can exploit this by pointing the URL to an allow-listed hostname that resolves to a private or loopback IP, causing the server to send GET requests to internal addresses that should be blocked.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in SurrealDB, check if your SurrealDB version is below 3.2.0. Use commands like 'surrealdb version' or inspect package metadata. Monitor network logs for unexpected internal requests from SurrealDB processes, especially to loopback or private IP ranges.

Useful 0 Not Useful 0

Impact Analysis

An attacker could infer internal host or port availability by observing response timing and JWKS parsing outcomes. While they cannot read responses or modify data, they can map internal network structures. This requires high privileges (Owner role) to exploit.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized network probing of internal systems. GDPR requires protecting personal data and ensuring secure processing, while HIPAA mandates safeguarding protected health information. The flaw allows attackers to infer internal host or port liveness, which could be used to map internal networks and identify potential targets for further attacks, thereby compromising data security and confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.2.0 or later immediately. Restrict Owner role privileges to reduce attack surface. Implement network egress filtering to block outbound requests to private or loopback IPs. Use trusted JWKS hosts with fixed public addresses if possible.

Useful 0 Not Useful 0