SurrealDB Silent Permission Overwrite Failure Vulnerability

A vulnerability exists in SurrealDB versions prior to 2.1.4, where the 'DEFINE TABLE ... OVERWRITE' clause fails to properly update table definitions for tables designated as 'TYPE RELATION'. This issue arises because the 'OVERWRITE' clause does not effectively modify the 'PERMISSIONS' settings for these tables. Consequently, an administrator may mistakenly believe that permission changes have been applied, while in reality, they have not. This oversight can allow clients with query authorization to access data in the table that the intended permission updates were meant to restrict.

Impact

The vulnerability can lead to unauthorized data access in tables of type 'RELATION', as permission changes intended to restrict access are not applied. This allows clients to access data they should not be able to after a permissions update.

Remediation

Users can upgrade to SurrealDB version 2.1.4 or later, where this issue is fixed. For those who have already attempted to update permissions on affected tables, it is recommended to verify the current permissions using the 'INFO FOR DB' statement. If the permissions are not as intended, the table will need to be removed and redefined from scratch with the correct permissions, although data can be backed up to a temporary table before doing so.