CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.0 are vulnerable due to an ordering flaw in the evaluation of user-supplied WHERE clauses, allowing authenticated users to bypass table-level permission checks and access full record data. This can lead to unauthorized data exfiltration, particularly when scripting functions are enabled, although it can also be exploited through other means like SurrealQL's THROW statement. Database administrators and security teams managing SurrealDB should prioritize this vulnerability to mitigate potential data breaches within their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.
Related CVEs
Other vulnerabilities affecting the same vendor(s)