SurrealDB SurrealQL Injection in Backup Import Leading to RCE (GHSA-ccj3-5p93-8p42)

Vulnerability Overview Vulnerability Name: Server takeover via SurrealQL injection on backup import Vulnerability ID: GHSA-ccj3-5p93-8p42 Severity: Critical (CVSS v4 base metrics: 9.4 / 10) Release Date: April 10, 2025 Discoverer: rowan-baker Remediation Provider: cure53 Description The SurrealDB command-line interface (CLI) allows exporting databases via the command. It was discovered that table names or field names are not properly escaped during export, leading to SurrealQL injection when importing the backup. For the injection to occur, an authenticated system user with the or role must create a table or field with a malicious name containing a SurrealQL injection payload, followed by exporting it via the operation. An attacker can achieve privilege escalation and root-level access to the SurrealDB instance if a user with higher privileges subsequently performs an operation. Additionally, applications using SurrealDB that allow users to define custom fields or tables are at risk of secondary injection, even if query parameters are correctly escaped. This issue was identified during a code audit and penetration test of SurrealDB. The severity was initially classified as Critical by cure53, which aligns with our CVSS v4 assessment. Impact This attack can be used to execute privilege escalation and fully compromise (root access) the SurrealDB instance, as well as to perform SurrealQL injection attacks against multiple applications that use SurrealDB as a shared backend. Remediation A patch has been created to resolve this issue by fixing a bug in the exporter that failed to escape certain characters. Versions 2.0.5, 2.1.5, 2.2.2, and later are not affected by this issue. Workaround For SurrealDB users unable to upgrade, it is mandatory to manually inspect the exported data for injection statements before executing the operation. References SurrealDB Documentation - Export SurrealDB Documentation - Import SurrealDB Documentation - Authentication Affected Versions Indicators of Compromise Attack Vector: Network Attack Complexity: Low Attack Requirements: None Privileges Required: Low User Interaction: Passive Vulnerable System Impact Metrics Confidentiality: High Integrity: High Availability: High Subsequent System Impact Metrics Confidentiality: High Integrity: High Availability: High CVE ID No known CVE Weakness CWE-77 Credits cure53 (Reporter)

Goal Reached Thanks to every supporter — we hit 100%!

SurrealDB SurrealQL Injection in Backup Import Leading to RCE (GHSA-ccj3-5p93-8p42)

More from this source