Description (CNA)
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| surrealdb / surrealdb | affected 0 before 1.5.4; unaffected 1.5.4 |
| surrealdb / surrealdb | affected 0 before 2.0.0-alpha.6; unaffected 2.0.0-alpha.6 |
| surrealdb / surrealdb | affected 0 before 1.5.1; unaffected 1.5.1 |
CWE
CWE-287
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2
- https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch
ADP enrichment
No English description supplied.
No references supplied.