Listen to this Post
The vulnerability exists in how SurrealDB handles the execution context of ‘future’ fields and stored function closures. A ‘future’ is a value computed only upon query. When a low-privilege user (e.g., a database editor) defines a ‘future’ field or a closure within a record, the embedded logic does not execute immediately. Instead, it lies dormant. The flaw is that when a higher-privileged user later queries or modifies that record, the stored logic executes within the invoker’s security context, not the original creator’s. This creates a classic confused deputy scenario. An attacker can therefore plant malicious code (e.g., a function to create a new root user) within a field. When an administrator interacts with that record, the attacker’s code runs with full administrative rights, leading to complete system compromise.
Platform: SurrealDB
Version: <2.5.0, <3.0.0-beta.3
Vulnerability: Privilege Escalation
Severity: Critical
date: 2024-08-15
Prediction: Patched 2024-08-15
What Undercode Say:
Check SurrealDB version
surreal version
Example malicious 'future' definition by attacker
UPDATE record:test SET malicious_field = future {
CREATE user:root SET password = 'hacked', roles = ['owner']
};
Query by admin triggering the exploit
SELECT FROM record:test;
How Exploit:
- Attacker with EDITOR role creates/updates a record with a malicious ‘future’ or function field.
- The field contains logic for privilege escalation (e.g., CREATE USER).
- Administrator or high-privilege user queries or writes to that record.
- The embedded logic executes with the administrator’s permissions.
- Attacker’s payload completes (e.g., new root user created).
Protection from this CVE
- Immediately upgrade to SurrealDB >=2.5.0 or >=3.0.0-beta.3.
- The patch enforces
auth_limit, binding execution permissions to the user who defined the logic. - It prevents storage of closures (can be re-enabled via `–allow-insecure-storable-closures` flag in v2.5.0).
- For SurrealDB 3.0, ‘futures’ are replaced by ‘computed’ fields within schemaful tables.
Impact:
Full privilege escalation leading to server takeover. Potential data exfiltration or Denial-of-Service via read actions if network capabilities are enabled.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
