CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 2.2.2 are vulnerable due to inadequate validation of HTTP redirects in their HTTP functions, allowing authenticated users to circumvent deny-net restrictions. This flaw enables attackers to exploit server-side request forgery (SSRF) by redirecting requests to blocked IP addresses, potentially exposing sensitive internal endpoints. Organizations using SurrealDB should prioritize patching to mitigate the risk of unauthorized access to internal data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.