CVE-2024-58361 surrealdb CVE debrief

Who should care

Users of SurrealDB versions before 2.0.4 should review and update their installations to prevent potential denial-of-service attacks via parser exception. This includes administrators, developers, and security teams responsible for maintaining and securing SurrealDB deployments. They should assess their exposure, apply patches or mitigations, and monitor for potential attacks.

Technical summary

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server. This vulnerability can lead to potential denial-of-service attacks. The vulnerability is caused by the lack of proper error handling in the parser, which allows an attacker to exploit this vulnerability by executing a malformed query.

Defensive priority

High priority should be given to updating SurrealDB installations to version 2.0.4 or later to prevent potential crashes due to uncaught exceptions. Additionally, review and restrict query execution to authorized clients, and monitor server logs for error rendering panics.

Recommended defensive actions

• Update SurrealDB to version 2.0.4 or later
• Review and restrict query execution to authorized clients
• Monitor server logs for error rendering panics
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and testing may be necessary to fully understand the impact and scope of the vulnerability. The vulnerability affects SurrealDB versions before 2.0.4 and involves an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server. Evidence is limited, and defenders should verify the vulnerability's impact on their specific deployments.

Official resources