SurrealDB LIVE Query DoS via WHERE Clause Errors

Executive Summary

SurrealDB versions before 3.1.0 have a denial of service vulnerability where malicious LIVE queries with WHERE clauses that cause evaluation errors block all CREATE, UPDATE, and DELETE operations on the affected table. An authenticated user with only select permission can exploit this to prevent write operations for any user, including root, by registering a LIVE query that triggers errors until the query is killed or the session ends.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual LIVE query registrations with WHERE clauses that cause errors. Check SurrealDB logs for repeated evaluation failures during write operations. Use database monitoring tools to track failed CREATE, UPDATE, or DELETE operations on watched tables.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with minimal privileges (only select permission) to disrupt database operations, making it impossible to modify data in the affected table. This can lead to data unavailability, system downtime, and potential loss of critical functionality until the malicious query is terminated or the session ends.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by causing data unavailability or corruption, which may violate availability requirements in GDPR and HIPAA. If critical data becomes inaccessible due to the DoS, organizations may fail to meet regulatory obligations for timely data access and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade SurrealDB to version 3.1.0 or later to patch the vulnerability.
• Restrict LIVE query registration by removing SELECT permissions from untrusted users.
• Implement application-layer controls to validate LIVE query registrations.
• Kill suspicious LIVE queries that trigger evaluation errors to restore write operations.

Useful 0 Not Useful 0