SurrealDB Format String Vulnerability in Scripting Functions

A format string vulnerability has been identified in SurrealDB versions prior to 1.1.1. This issue resides in the rquickjs Exception::throw_type function, which is used to execute scripting functions within SurrealDB. When scripting is enabled, attackers with scripting privileges can inject format string sequences into error inputs, potentially leading to arbitrary memory read or execution of code with SurrealDB process privileges.

Impact

Exploitation of this vulnerability could allow an attacker to read arbitrary memory from the SurrealDB process or execute arbitrary code with the same privileges as the SurrealDB process.

Remediation

Users can update to SurrealDB version 1.1.1 or later, which addresses this vulnerability. For those unable to update, it is recommended to restrict access to scripting functions from untrusted users, either by removing scripting capability by default or using the --deny-scripting option. If neither option is feasible, limit network access to trusted users.