🚨High - SurrealDB RPC API Query Injection via Signin/Signup (CVE-2024-58362) SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the RPC API's signin and signup operations without recursively validating it. Where a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an attacker can supply a bincode-encoded object containing a subquery in place of credentials. That subquery executes inside the database owner's SIGNIN/SIGNUP query under a system session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources. Results aren't directly readable and IAM resources (owner-only) are unaffected. CVSS 8.7. 👉Upgrade SurrealDB to 1.5.5 or 2.0.0-beta.3 (surrealdb-core 1.5.2).
Post summary
The post outlines a CVE‑2024‑58362 RPC API query injection vulnerability in SurrealDB and recommends upgrading to 1.5.5 or 2.0.0‑beta.3 to mitigate the issue.
