CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 2.0.5, 2.1.5, and 2.2.2 are vulnerable due to improper escaping of table and field names in the command-line export command, allowing authenticated users with OWNER or EDITOR roles to inject malicious SurrealQL. This vulnerability can lead to privilege escalation and potential root-level takeover when a higher-privileged user imports the compromised backup. Organizations using SurrealDB, especially those allowing user-defined tables or fields, should prioritize addressing this issue to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
Related CVEs
Other vulnerabilities affecting the same vendor(s)