PT-2024-40433 · Surrealdb · Surrealdb

Published 2024-10-08 · Updated 2024-10-08

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.4

Description The issue occurs when the parser fails to handle the conversion of an empty string to a SurrealDB value, such as when casting to a record, duration, or datetime, or when parsing an empty string to JSON. This can cause a panic in the error rendering code, leading to a denial of service. An authorized client can execute a malformed query that fails to parse, causing the server to crash.

Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue. As a temporary workaround, consider limiting the ability of untrusted clients to run arbitrary SurrealQL queries. Additionally, ensure that the SurrealDB process is configured to automatically restart after a crash to minimize the impact of the denial of service.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

GHSA-QJRV-V6QP-X99X

Affected Products

Surrealdb

References · 5

• https://osv.dev/vulnerability/GHSA-qjrv-v6qp-x99x · Vendor Advisory
• https://github.com/surrealdb/surrealdb · Note
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x · Note
• https://github.com/surrealdb/surrealdb/commit/709d6efe901dbf3e207b4fc2ebc30775595efc16 · Note
• https://github.com/surrealdb/surrealdb/pull/4923 · Note