SurrealDB Field-Level SELECT Bypass via Indexed COUNT Queries

Executive Summary

This vulnerability affects SurrealDB versions before 3.1.0. It allows attackers with table-level SELECT permissions to bypass field-level restrictions and infer values of hidden fields by exploiting indexed COUNT fast paths. Attackers can repeatedly guess field values using COUNT queries on indexed fields, even when direct read access is blocked.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor SurrealDB instances running versions before 3.1.0 for unusual COUNT queries on indexed fields with field-level SELECT restrictions. Check logs for repeated queries like SELECT count() FROM t WHERE hidden_field = 'guess' GROUP ALL. Use SurrealDB's logging features to track query patterns and identify unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use SurrealDB versions before 3.1.0, an attacker with limited permissions could potentially recover sensitive data from restricted fields. This could lead to unauthorized data exposure, privacy breaches, or information leakage. The impact is limited to data inference and does not allow modification or privilege escalation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to restricted personal or sensitive data. Organizations using affected SurrealDB versions may face compliance risks, potential fines, and reputational damage due to insufficient field-level access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later immediately. If upgrading is not possible, avoid defining indexes on fields protected by field-level SELECT permissions. Restrict COUNT query execution and implement namespace/database isolation as temporary mitigations.

Useful 0 Not Useful 0