Critical Format String Flaw in SurrealDB

SurrealDB versions prior to 1.1.1 are susceptible to a critical format string vulnerability, identified as CVE-2024-58366, which carries a CVSS score of 8.5. This flaw exists within the rquickjs Exception::throw_type function and can be triggered by attackers who possess scripting privileges, potentially leading to unauthorized memory access or remote code execution.

What's at Risk

The vulnerability affects SurrealDB deployments running versions earlier than 1.1.1. Organizations utilizing this database management system are at risk if their environments allow for user-supplied scripting inputs, particularly in internet-facing or multi-tenant configurations.

Systems that expose scripting interfaces to potentially untrusted users are at the highest level of exposure. Because the vulnerability allows for execution with the SurrealDB process privileges, any compromise could grant an attacker the same level of access as the database service itself, which often includes broad read and write capabilities across the underlying host environment.

How the Flaw Works

A format string vulnerability occurs when an application takes user-supplied input and passes it directly into a function that interprets format specifiers, such as printf in C or similar mechanisms in other languages. In a general security context, this type of weakness allows an attacker to control how the application processes data, often by injecting special sequences like %x or %n into the input stream.

By manipulating these specifiers, an attacker can trick the application into reading data from the stack or writing data to arbitrary memory locations. When successfully exploited, this class of vulnerability can lead to unauthorized information disclosure, where sensitive data is leaked from memory, or full system compromise, where the attacker overwrites return addresses or function pointers to hijack the control flow of the application.

How to Protect Your Systems

• Immediately upgrade all SurrealDB instances to version 1.1.1 or later to patch the vulnerable rquickjs component.
• Audit all existing scripts and database functions to ensure that user-supplied input is properly sanitized before being passed to error handling or logging mechanisms.
• Restrict scripting privileges to trusted administrative accounts only to minimize the attack surface.
• Implement network segmentation to ensure that the database server is not directly accessible from the public internet unless strictly necessary.
• Monitor system logs for unusual error patterns or unexpected process behavior that could indicate an attempt to exploit the scripting engine.
• Follow vendor-provided hardening guides to ensure the database is running with the principle of least privilege.

Given the critical severity of this vulnerability and the potential for arbitrary code execution, administrators should prioritize patching as a matter of urgency. Failing to address this flaw leaves the database environment exposed to attackers who can leverage the scripting interface to gain unauthorized control over the host system.