CVE-2023-54366: SurrealDB before 1.0.1 Insecure Default Table Permissions
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 1.0.1 - Configuration
Ensure default table permissions are set to NONE (so tables without explicit permissions cannot be used for SELECT/CREATE/UPDATE/DELETE).
SurrealDB default table permissions = NONE
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54366?
The severity of CVE-2023-54366 is rated high with a score of 8.7.
How do I fix CVE-2023-54366?
To fix CVE-2023-54366, upgrade to SurrealDB version 1.0.1 or later, which addresses the insecure default table permissions.
What are the consequences of CVE-2023-54366?
CVE-2023-54366 allows unauthorized database access, enabling attackers to perform SELECT, CREATE, UPDATE, and DELETE operations on tables.
Who is affected by CVE-2023-54366?
Users of SurrealDB versions prior to 1.0.1 are affected by CVE-2023-54366 if they have publicly exposed instances or have inadequate access controls.
What types of operations can be executed due to CVE-2023-54366?
CVE-2023-54366 permits unrestricted SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions.