SurrealDB Arbitrary File Read via DEFINE ANALYZER

Executive Summary

SurrealDB before version 3.1.5 has an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter. Users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying arbitrary file paths in the mapper filter. This works when the SURREAL_FILE_ALLOWLIST is empty or not configured, allowing attackers to retrieve file contents through query error messages.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SurrealDB versions before 3.1.5. Use commands like 'surreal version' or inspect package managers for outdated installations. Monitor logs for DEFINE ANALYZER queries with file paths in mapper filters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose sensitive data such as startup credentials or environment variables. Attackers can read files accessible to the SurrealDB process, potentially leading to privilege escalation or further system compromise. The impact depends on the filesystem access of the SurrealDB process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Exposure of personal or health data may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.1.5 or later. Configure SURREAL_FILE_ALLOWLIST to restrict file access. Limit permissions for EDITOR and OWNER roles. Avoid storing secrets in command-line arguments.

Useful 0 Not Useful 0