CVE-2024-58358: SurrealDB denial of service via nonexistent role conversion

Executive brief

SurrealDB is a multi-model database platform. An administrator with owner privileges can create database user accounts with invalid role names. When these accounts are used (such as during sign-in), the server crashes instead of gracefully rejecting the invalid role, causing the database to become unavailable. This requires privileged access but results in a complete denial of service.

Technical details

The vulnerability exists in SurrealDB's role conversion logic. System user roles are stored as generic Ident values and must be converted to a Role enum during IAM operations. The conversion expects only three valid roles: owner, editor, and viewer. However, the From trait implementation calls unwrap() on the conversion result without validation, causing a panic when an invalid role name is encountered. A privileged owner-role user can exploit this by defining a user with a nonexistent role using the DEFINE USER statement. When that user attempts to sign in or other IAM operations reference the invalid role, the server panics, causing denial of service. The fix (available in version 2.1.0+) validates roles during parsing and returns an InvalidRole error instead of panicking.

Affected products

• SurrealDB SurrealDB < 2.1.0
• SurrealDB surrealdb-core < 2.1.0

Timeline

• 2024-11-22: disclosed: Vulnerability disclosed via GitHub Advisory
• 2024-11-22: patched: Fix available in version 2.1.0

References

• https://api.github.com/users/garyhai
• https://github.com/garyhai
• https://api.github.com/users/garyhai/gists%7B/gist_id%7D
• https://api.github.com/users/garyhai/repos
• https://avatars.githubusercontent.com/u/177827?v=4
• https://api.github.com/users/garyhai/events%7B/privacy%7D