Format String Bug Found in SurrealDB

A newly disclosed security vulnerability has emerged within the SurrealDB platform, centered on its handling of internal scripting errors. The flaw resides in the rquickjs component, specifically within the Exception::throw_type function, creating a condition that could have significant implications for system integrity.

The Nature of the Flaw

Identified as CVE-2024-58366, this security issue is classified as a format string vulnerability. The bug is present in all versions of the database platform preceding 1.1.1. When scripting functionality is active, the database's error-handling mechanism fails to sanitize inputs correctly.

Impact on System Security

The technical defect allows for the submission of specific format string sequences within error inputs. According to the advisory, this provides a mechanism for an attacker to potentially read arbitrary memory segments. Furthermore, the vulnerability may permit the execution of code, operating under the same permissions as the SurrealDB process itself.

Technical Specifications

• Advisory ID: GHSA-qcfm-cmfw-f4x4
• Affected Versions: Before 1.1.1
• Severity Rating: Critical
• CVSS Score: 8.5

Understanding the Risk

The discovery of this vulnerability highlights a technical risk for users of the database who have enabled scripting features. Because the flaw allows for unauthorized memory access and potential code execution, the primary concern centers on the scope of the process privileges held by the database instance. Given that these permissions are tied to the execution environment of the software, any unauthorized interaction with the Exception::throw_type function could result in a breach of the expected isolation between user input and system processes.