SurrealDB JWKS SSRF via Redirect Bypass

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in SurrealDB versions before 3.1.5. It occurs in the JWKS fetcher which follows HTTP redirects without re-validating the redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SurrealDB instance is running a version prior to 3.1.5. Use the command: surrealdb version. If the version is below 3.1.5, the system is vulnerable. Additionally, monitor network logs for unexpected outbound requests from the SurrealDB process, especially to internal or blocked addresses.

Useful 0 Not Useful 0

Impact Analysis

An attacker could make the server send HTTP requests to internal services or blocked addresses, potentially accessing sensitive internal resources. However, the attack is blind as the server only parses the response as a JWKS and returns an InvalidAuth error if it fails, so no data is read or modified.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized network access. GDPR requires protecting personal data and implementing security measures to prevent unauthorized access. HIPAA mandates safeguards to ensure the confidentiality and integrity of protected health information. The vulnerability's ability to bypass network restrictions could lead to unauthorized data exposure or access, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SurrealDB to version 3.1.5 or later. If upgrading is not possible, restrict the Owner role permissions, enforce network-level egress filtering to block unauthorized outbound connections, and avoid using remote JWKS hosts that may redirect to internal addresses.

Useful 0 Not Useful 0