Description
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | 3.1.0 – < 3.3.0 | 3.3.0 |
References
- GitHub Security Advisory (GHSA-h3mp-7wcg-p6vj) vendor-advisory
- VulnCheck Advisory: SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass third-party-advisory