SurrealDB method-style calls bypass --deny-funcs function limits
Logged-in users on a database server can secretly use blocked features.
Summary
In SurrealDB 2.0.0 before 3.3.1, method-style function calls in the streaming engine ignore --deny-funcs restrictions. Authenticated users who can submit queries can run denied functions and read and write file bucket data.
Affected when
- --deny-funcs restrictions in use
- Streaming engine in use (default in 3.x)
- Authenticated users who can submit queries
What to do
Update to SurrealDB 3.3.1. Versions before 3.3.1 are affected.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen