CVE-2024-58356: SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 2.1.4Patch Permission Bypass via DEFINE TABLE OVERWRITE - Operational
After upgrading to SurrealDB 2.1.4, re-apply any table permission changes intended to be enforced via DEFINE TABLE ... OVERWRITE, since SurrealDB before 2.1.4 can silently fail to overwrite table definitions for tables defined with TYPE RELATION.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58356?
The severity of CVE-2024-58356 is classified as low with a CVSS score of 2.3.
How do I fix CVE-2024-58356?
To fix CVE-2024-58356, upgrade SurrealDB to version 2.1.4 or later.
What systems are affected by CVE-2024-58356?
CVE-2024-58356 affects SurrealDB versions prior to 2.1.4.
What is the nature of the vulnerability in CVE-2024-58356?
CVE-2024-58356 is a permission bypass vulnerability related to the DEFINE TABLE OVERWRITE clause in SurrealDB.
Are there any workarounds for CVE-2024-58356?
There are no known workarounds for CVE-2024-58356 other than upgrading to the latest version of SurrealDB.