Description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
surrealdb surrealdb
Default version status: unaffected
2.2.0 to < 2.2.2affected2.2.2unaffected
pkg:cargo/surrealdbsurrealdb surrealdb
Default version status: unaffected
2.1.0 to < 2.1.5affected2.1.5unaffected
pkg:cargo/surrealdbsurrealdb surrealdb
Default version status: unaffected
0 to < 2.0.5affected2.0.5unaffected
pkg:cargo/surrealdb