Improper Authorization in SurrealDB Allows Unauthorized Access to Field Values

CVE-2024-58367

What is CVE-2024-58367?

SurrealDB versions prior to 2.0.4 contain a security vulnerability that fails to properly enforce field permissions during critical operations such as SELECT, UPDATE, and DELETE. This oversight enables authorized users to illicitly access sensitive field values through a variety of query techniques. Attackers can exploit functionalities related to SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references, thereby exposing protected data even when proper SELECT permissions are not granted. This vulnerability poses a significant risk to data confidentiality and integrity.

References