GHSA-p296-7pr4-87rr: SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file:: denials.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.1
Event History
Frequently Asked Questions
Who is exposed to this bypass?
SurrealDB deployments running versions from 2.0.0 before 3.3.1 are exposed if they rely on --deny-funcs restrictions and allow authenticated users to submit queries. The issue affects the streaming engine's handling of method-style function calls.
What does an attacker need to exploit it?
An attacker needs authenticated access with the ability to submit SurrealDB queries. No user interaction is required, and denied functions can be invoked using method syntax rather than direct function-call syntax.
Can this be used to access file bucket data despite file function denials?
Yes. The advisory describes use of $f.put() and $f.get() method-style calls to write and read file bucket data even when file::* functions are denied.
What should be done to remediate the issue?
Upgrade SurrealDB to version 3.3.1 or later. Until upgrading, do not treat --deny-funcs as an effective restriction against authenticated users who can submit queries using method-style syntax.