SurrealDB Insecure Default Table Permissions Vulnerability

A vulnerability exists in SurrealDB versions prior to 1.0.1, where default table permissions are set to FULL instead of NONE. This misconfiguration allows SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. As a result, attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

Impact

This vulnerability allows full access to unprotected tables for any client authorized to query data in SurrealDB. This includes the ability to create, read, update, and delete data. The issue is particularly concerning for instances that allow guest access through public interfaces like the HTTP REST API or WebSocket API, as it could enable remote unauthenticated users to gain complete access to tables without explicit permissions.

Remediation

Users can upgrade to SurrealDB version 1.0.1 or later, where this vulnerability has been addressed. In version 1.0.1 and later, tables defined without explicit permissions have NONE permissions by default, and the permissions are clearly displayed with the INFO FOR DB statement. For those using an unpatched version, it is recommended to explicitly define table permissions when creating tables.