GHSA-x6mm-9295-rvph: SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running SurrealDB 3.1.0 through versions before 3.3.0 are affected when restricted fields have SELECT permissions and are used by the streaming planner through full-text, compound B-tree, or HNSW KNN indexes.
What access does an attacker need?
An attacker needs record-user-level access that allows them to issue queries. No user interaction is required, and the issue can be exercised remotely over the network.
What information can be exposed?
An attacker can infer values in fields that should be restricted by determining whether records contain guessed values through full-text MATCHES or compound B-tree queries. HNSW KNN queries can similarly reveal information about nearest vectors.
What is the available remediation?
Upgrade SurrealDB to version 3.3.0 or later. The provided data does not identify a workaround for environments that cannot upgrade immediately.