Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2024-58356 medium CVSS 6.3

Vulnerability in surrealdb (CVE-2024-58356)

Summary

Vulnerability in surrealdb (CVE-2024-58356). Risk of unauthorized operations or information disclosure. Exploitable via OVERWRITE. Mitigation: upgrade to 2.1.4 or later.

Original description

The description as published by the source.

The OVERWRITE clause of the DEFINE TABLE statement would fail to overwrite data for tables that were defined with TYPE RELATION. Since table definitions include the PERMISSIONS clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.

Impact

If a user attempted to update table permissions of a table defined with TYPE RELATION using DEFINE TABLE ... OVERWRITE, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.

Patches

The DEFINE TABLE statement has been updated to appropriately overwrite data for tables defined with TYPE RELATION.

  • Version 2.1.4 and later are not affected by this issue.

Workarounds

Users of tables with TYPE RELATION that may have been modified using the OVERWRITE clause in order to update permissions are advised to verify that the intended permissions are in place using the INFO FOR DB statement. Affected users who are unable to update and require updating permissions in a table with TYPE RELATION will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.

References

  • [#5260](h…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2024-58356 has been found in surrealdb.
Attackers can target a specific entry point like OVERWRITE over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.3/10.
What to do: upgrade surrealdb to 2.1.4 or later.
If unsure, ask your IT team or search "surrealdb CVE-2024-58356" on the vendor's site.

CVE-2024-58356 (surrealdb) — CWE-732 / CVSS v3 6.3
Attack vector: remote (network-reachable) / no user interaction
Attack surface: OVERWRITE / PERMISSIONS
Patched: 2.1.4 — apply immediately
Workaround: Users of tables with TYPE RELATION that may have been modified using the OVERWRITE clause in order to update permissions are advised to verify that the intended permissions are in place using the INFO FOR DB statement.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-732) exists in surrealdb. Attackers reach the vulnerable code path via OVERWRITE.

📍 Affected scope

Check the vendor advisory for the affected versions of surrealdb. Attack surface: OVERWRITE / PERMISSIONS.

🔥 Severity

Severity: Medium (CVSS 6.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 2.1.4.

🛡️ Workaround

Workaround: Users of tables with TYPE RELATION that may have been modified using the OVERWRITE clause in order to update permissions are advised to verify that the intended permissions are in place using the INFO FOR DB statement.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'surrealdb' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'surrealdb' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で surrealdb を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Users of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement.

    パッチが適用されるまでの応急処置として、Users of tables with TYPE RELATION that may have been modified using the OVERWRITE clause in order to update permissions are advised to verify that the intended permissions are in place using the INFO FOR DB statement. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade surrealdb to 2.1.4

    ステージング環境で 2.1.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

rust surrealdb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}]
rust surrealdb-core
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}]
crates.io surrealdb
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.4"}]}]
crates.io surrealdb-core
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.1.4"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details