Description
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
surrealdb surrealdb
Default version status: unaffected
0 to < 3.3.0affected3.3.0unaffected
pkg:cargo/surrealdbReferences
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-vx2p-7hhm-wv62 ↗
- https://github.com/surrealdb/surrealdb/commit/5000e233b4a8b96689c82715c172061dcf711d31 ↗
- https://github.com/surrealdb/surrealdb/blob/v3.2.4/surrealdb/server/src/ntw/auth.rs ↗
- https://github.com/surrealdb/surrealdb/releases/tag/v3.3.0 ↗
- https://github.com/surrealdb/surrealdb ↗
- https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-headers ↗