Description
SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 1.5.4, 2.0.0-alpha.1 – < 2.0.0-alpha.6 | 1.5.4 |
| surrealdb | surrealdb-core | < 1.5.1 | 1.5.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | < 1.5.4 | 1.5.4 | GHSA-gh9f-6xm2-c4j2 |
| crates.io | surrealdb | >= 2.0.0-alpha.1, < 2.0.0-alpha.6 | 2.0.0-alpha.6 | GHSA-gh9f-6xm2-c4j2 |
| crates.io | surrealdb-core | < 1.5.1 | 1.5.1 | GHSA-gh9f-6xm2-c4j2 |
References
- GitHub Security Advisory (GHSA-gh9f-6xm2-c4j2) vendor-advisory
- VulnCheck Advisory: SurrealDB before 1.5.4 Authentication Bypass via Database Switch third-party-advisory