Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2024-58363 medium CVSS 6.3

Authentication Bypass in surrealdb (CVE-2024-58363)

Summary

Authentication bypass in surrealdb (CVE-2024-58363). Risk of unauthorized operations or information disclosure. Exploitable via use. Mitigation: upgrade to 2.0.0-alpha.6 or later.

Original description

The description as published by the source.

Authentication would not be properly validated when an already authenticated scope user would use the use method or USE clause to switch working databases in a session. If there was a user record in the new database with identical record identifier as the original record that the user authenticated with in the original database, this could result in the user being able to perform actions under the identity of the unrelated user in the new database. This issue does not affect system users at any level.

By default, record identifiers are randomly generated with sufficient complexity to prevent the identifier collision required to trigger this issue. However, the issue may trigger in situations where multiple databases in the same SurrealDB instance are using explicitly defined or incremental record identifiers to identify users on an identically named table.

Impact

Under the circumstances described above, a user who has an authenticated session as a scope user in a database could become authorized to query data under the identity of a specific scope user associated with an identical record identifier in a different database within the same SurrealDB instace if the PERMISSIONS clause would allow it due to relying exclusively on the $auth parameter, which would point to the impersonated user. The impact is limited to the single user with matching record identifier.

The impact of this issue is mitigated if the table PERMISSIONS clause explicitly checks for an sco…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2024-58363 has been found in surrealdb.
Attackers can target a specific entry point like use over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.3/10.
What to do: upgrade surrealdb to 2.0.0-alpha.6 or later.
If unsure, ask your IT team or search "surrealdb CVE-2024-58363" on the vendor's site.

CVE-2024-58363 (surrealdb) — CWE-287 / CVSS v3 6.3
Attack vector: remote (network-reachable) / no user interaction
Attack surface: use / USE / PERMISSIONS / NONE
Patched: 2.0.0-alpha.6 — apply immediately
Workaround: Users unable to update may want to ensure that table PERMISSIONS clauses explicitly check that the $scope parameter matches a scope that is uniquely named across databases in the same SurrealDB instance.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Authentication bypass (CWE-287) exists in surrealdb. Attackers reach the vulnerable code path via use.

📍 Affected scope

Check the vendor advisory for the affected versions of surrealdb. Attack surface: use / USE / PERMISSIONS / NONE.

🔥 Severity

Severity: Medium (CVSS 6.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 2.0.0-alpha.6.

🛡️ Workaround

Workaround: Users unable to update may want to ensure that table PERMISSIONS clauses explicitly check that the $scope parameter matches a scope that is uniquely named across databases in the same SurrealDB instance.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'surrealdb' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'surrealdb' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で surrealdb を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Users unable to update may want to ensure that table `PERMISSIONS` clauses explicitly check that the `$scope` parameter matches a scope that is uniquely named across databases in the same SurrealDB instance.

    パッチが適用されるまでの応急処置として、Users unable to update may want to ensure that table PERMISSIONS clauses explicitly check that the $scope parameter matches a scope that is uniquely named across databases in the same SurrealDB instance. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade surrealdb to 2.0.0-alpha.6

    ステージング環境で 2.0.0-alpha.6 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

rust surrealdb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
crates.io surrealdb
[{"type":"SEMVER","events":[{"introduced":"2.0.0-alpha.1"},{"fixed":"2.0.0-alpha.6"}]}]
crates.io surrealdb-core
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details