GHSA-h3mp-7wcg-p6vj: SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs database Owner-level privileges to configure a JWT or record access method with a JWKS URL. The issue is therefore most relevant where Owner access is granted to untrusted or insufficiently trusted users.
Are systems using port-specific deny-net rules affected by default?
The vulnerability affects deployments that rely on port-specific deny-net rules and have denied internal services on port 80 or 443. A JWKS URL that omits those default ports can bypass the corresponding explicit port restriction.
What network activity occurs during exploitation?
SurrealDB makes blind GET requests to the attacker-selected JWKS URL. This can reach explicitly denied internal services when the URL uses an implicit default HTTP or HTTPS port.