Executive brief
SurrealDB is a NoSQL database that provides an HTTP REST API for database access. A flaw in the parsing of certain HTTP headers (ID, DB, and NS) allows an unauthenticated attacker to crash the entire database server by sending specially crafted requests with special characters in header values. This results in complete service outage until the server is manually restarted.
Technical details
This is an uncaught exception vulnerability in the HTTP header parsing logic of SurrealDB's REST API. The vulnerability affects the ID, DB, and NS headers, which fail to properly validate or sanitize input containing special characters, triggering a panic that crashes the process. The attack vector is over the network (HTTP), requires no authentication or user interaction, and can be triggered by any unauthenticated client with network access to the exposed REST API interface. An attacker can achieve a complete denial of service by repeatedly sending malformed requests. The fix is available in version 1.1.0 and later. This issue affects only the SurrealDB binary server; the library is not affected.
Affected products
- SurrealDB SurrealDB < 1.1.0
Timeline
- 2024-01-18: disclosed: Advisory published to GitHub Advisory Database
- 2024-01-17: advisory: Advisory created in GitHub repository
- 2024-01-17: patched: Fix available in version 1.1.0