SurrealDB Authorization Bypass: Data Leakage via Pre-Auth Expression Evaluation in WHERE/SET

Vulnerability Overview This vulnerability involves data access issues related to the order of permission checks. Specifically, user-supplied expressions (such as , , , ) are executed before table-level permission checks, potentially leading to data leakage or side effects. Impact Scope Affected Files: - - - - - - - - - Specific Impact: - In expressions such as , , , and , if sensitive data (e.g., ) is included, this data may be evaluated before permission checks, leading to data leakage. Remediation 1. Adjust Permission Check Order: - In , adjust the execution order of to ensure table-level permission checks are performed before evaluating user-supplied expressions. - Specific modifications include calling first in methods such as and . 2. Update Test Cases: - Add test cases in and to verify the fixed behavior. - Test cases include operations such as , , , , , and , ensuring that sensitive data is not evaluated prior to permission checks. POC Code ```sql -- where_permissions_data_leak.sql -- reason = "User-supplied expressions (WHERE, SET, MERGE, CONTENT) must not execute before table-level permission checks, preventing data exfiltration via THROW or side effects" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -- [[test.results]] -- value = "[]" -

Goal Reached Thanks to every supporter — we hit 100%!

SurrealDB Authorization Bypass: Data Leakage via Pre-Auth Expression Evaluation in WHERE/SET

More from this source