SurrealDB SSRF Bypass via DNS Resolution of Deny-Net Flags

SurrealDB Vulnerability Summary Overview Vulnerability Name: Bypass of deny-net flags via DNS resolution CVE ID: GHSA-m3c3-78fh-w3w7 Publication Date: June 26, 2025 Severity: Medium (5.8 / 10) CVSS Score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/SC:N Affected Versions Affected Versions: - SurrealDB (Rust) <3.0.0-alpha.7, <2.3.6, <2.2.6, <2.1.8 Fixed Versions: - 2.3.6, 2.2.6 Remediation Patch: A patch has been created to validate resolved hostnames against allowed network targets, preventing the function from connecting to prohibited IPs. Unaffected Versions: - Versions 2.2.6, 2.3.6, and later are not affected by this issue. - The first release after 2.1.7 and 3.0.0-alpha.7 is also unaffected. Method of Bypass Description: SurrealDB's function allows access to external network endpoints. Typically, a discouraged configuration involves starting SurrealDB with network connections allowed for all destinations except for a specific deny list. For example, allows all network connections except those within the 10.0.0.0/8 block. Exploitation: An authenticated SurrealDB user can utilize the function, where the hostname resolves to an IP within the block. For instance, if a SurrealDB administrator aims to restrict access to other services within a private network by setting to specific network IP ranges, an attacker can bypass this restriction by leveraging DNS records and hostname resolution. Outcome: When a SurrealDB statement containing the function is executed, if the hostname resolves to a prohibited IP, the SurrealDB server will still issue the request and return the response to the attacker. Impact Final Impact: The impact of this vulnerability depends on the deployment scenario. For example, if a SurrealDB server blocks requests to internal/private IP addresses because those services do not require authentication, but an attacker can still use SurrealDB to resolve the hostname via DNS and invoke these services directly using , the attacker can directly access these internal endpoints. This may allow the retrieval or even overwrite of sensitive information and credentials. Workarounds Risk Reduction: The likelihood of this vulnerability being exploited can be reduced by enabling the function using an allow-list approach, such as or using the equivalent environment variable, where the allowed endpoints are fully trusted and not under the attacker's control. Disabling the Feature: Alternatively, network access functionality can be disabled by using or the equivalent environment variable without specifying targets. This will disable all outbound HTTP traffic, which may affect SurrealDB functionality. Best Practices: Since the impact of this vulnerability depends on the security posture of the SurrealDB deployment environment, the following best practices should be followed. References GHSA-m3c3-78fh-w3w7 SurrealDB Documentation - Environment Variables SurrealDB Documentation - Capabilities SurrealDB Documentation - Network Access Capability

Goal Reached Thanks to every supporter — we hit 100%!

SurrealDB SSRF Bypass via DNS Resolution of Deny-Net Flags

More from this source