SurrealDB GHSA-h2c3-549c-gjpr: PATCH copy/move/test JSON Pointer bypasses field-level SELECT permissions

Vulnerability Overview Vulnerability Name: PATCH copy/move/test JSON Pointer operations bypass field-level SELECT permissions Vulnerability ID: GHSA-h2c3-549c-gjpr Severity: High (7.1 / 10) Description: Users with table-level write permissions can read data hidden by field-level clauses via , , , , or operations. The vulnerability involves the , , , and clauses, which evaluate their right-hand side operands under permission-reduced views. The previous fix (GHSA-f9qq-5mvm-922m) only addressed issues with empty root pointers, named arrays, nested fields, array elements, or objects containing restricted fields, but did not address unused fields. Scope of Impact Affected Versions: < 3.3.0 Fixed Version: 3.3.0 Impact: - Any deployment using field-level to hide fields may be affected. - Attackers can exploit this vulnerability to read restricted fields and copy them to unrestricted destinations. - Attackers can read restricted fields nested within objects, array elements, or arrays containing restricted fields. Remediation Patch: - The , , and path pointers are no longer rejected when reading fields. - Each pointer is checked to determine if it resolves to a restricted field within a permission-reduced view when resolving the record it points to. - If a restricted field is resolved, the statement fails instead of returning a value. - This check applies to all statement types with clauses, sharing the pointer resolution logic to apply the patch. Proof of Concept (POC) References SurrealDB Documentation — UPDATE statement SurrealDB Documentation — DEFINE FIELD SurrealDB Documentation — DEFINE TABLE — PERMISSIONS Fix(doc): reject PATCH read pointers into SELECT-restricted fields (included in SurrealDB 3.3.0) Fix(expr): resolve a JSON Patch array index as the element it names (included in SurrealDB 3.3.0) Acknowledgments Thanks to Yanhaosi for reporting this issue.

Goal Reached Thanks to every supporter — we hit 100%!

SurrealDB GHSA-h2c3-549c-gjpr: PATCH copy/move/test JSON Pointer bypasses field-level SELECT permissions

More from this source