Description (CNA)
SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| surrealdb / surrealdb | affected 0 before 3.1.0; unaffected 3.1.0 |
CWE
CWE-918
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-97vg-427p-8hx5
- https://www.vulncheck.com/advisories/surrealdb-before-port-specific-deny-rule-bypass-via-http-redirect
ADP enrichment
No English description supplied.
No references supplied.