GHSA-c9wc-jcr5-8974: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver isprivateip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are exposed?
SurrealDB deployments running version 3.2.0 before 3.3.0 are affected when authenticated users can invoke SurrealQL HTTP functions that cause the server to make outbound HTTP requests.
What does an attacker need to exploit this issue?
An attacker needs authenticated access and the ability to trigger outbound HTTP requests through SurrealQL HTTP functions. They can use NAT64, 6to4, or Teredo IPv6 transition addresses that embed private IPv4 destinations.
What systems could be reached if exploitation succeeds?
The bypass can allow requests to localhost, internal services, and cloud metadata endpoints that the SSRF guard is intended to block.
What is the available remediation?
Upgrade SurrealDB to version 3.3.0 or later. The affected range is 3.2.0 before 3.3.0.