Authorization Bypass in SurrealDB via JSON Patch Pointer Manipulation

Executive Summary

SurrealDB before version 3.3.0 has an authorization bypass flaw where users with table-level write permissions can read fields restricted by SELECT permissions. Attackers exploit JSON Patch pointers against unreduced records to copy or move hidden fields into readable locations using PATCH operations. They can also use test mismatch errors to disclose sensitive data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SurrealDB versions before 3.3.0 by running: surrealdb version. If the version is below 3.3.0, the system is vulnerable. Monitor for unusual PATCH operations targeting JSON fields, especially copy, move, or test operations that may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use SurrealDB versions before 3.3.0 and grant table-level write permissions to users who should not access certain fields, those users could bypass restrictions and read sensitive data. This could lead to unauthorized data exposure or leaks of confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized access to protected data. Organizations using affected versions may fail to meet data protection standards due to insufficient field-level access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SurrealDB to version 3.3.0 or later. If upgrading is not possible, restrict table-level write permissions to users who must not access SELECT-restricted fields. Avoid granting write access to users who should only have read permissions on specific fields.

Useful 0 Not Useful 0