SurrealDB Security Flaw Identified

Security researchers have identified a critical vulnerability within the SurrealDB database management system that affects versions prior to 1.1.1. The flaw centers on the handling of specific inputs when the database's scripting functionality is active.

The issue is documented as CVE-2024-58366 and has been assigned a severity rating of critical, carrying a CVSS score of 8.5. The vulnerability is located within the rquickjs Exception::throw_type function.

Exploiting Scripting Privileges

The core of the security risk arises when users or entities possess scripting privileges within the SurrealDB environment. Under these conditions, an attacker can input format string sequences into the error-handling mechanisms of the database.

By manipulating these inputs, an attacker may be able to read arbitrary memory contents. In more severe scenarios, the vulnerability could allow for the execution of code, operating with the same system privileges as the SurrealDB process itself.

Technical Risk Profile

The threat is contained within the architectural integration of the rquickjs scripting component. Because this component interacts directly with the database process, vulnerabilities in its exception handling logic expose the underlying system to unauthorized interaction.

• Advisory Identifier: GHSA-qcfm-cmfw-f4x4
• Affected software: SurrealDB versions before 1.1.1
• Severity metric: CVSS 8.5

Implications for Security

For organizations utilizing SurrealDB, the primary implication is that the security of the host environment is tied to the integrity of the scripting engine. When scripting features are enabled, the database environment provides a potential vector for escalation if input sanitization is bypassed through format string sequences. Developers and administrators may need to evaluate their usage of scripting privileges and ensure that all instances are updated to version 1.1.1 or later to address this specific vulnerability.