Executive brief
SurrealDB is a database platform that provides HTTP functions to access external network endpoints. A critical security feature called "deny-net" allows administrators to block requests to specific IP ranges (e.g., internal or private networks). This vulnerability allows an authenticated database user to bypass these network restrictions by hosting a malicious server that redirects HTTP requests to blocked addresses. An attacker can retrieve sensitive data from internal services that are normally unreachable, such as AWS metadata endpoints, potentially exposing credentials and other confidential information.
Technical details
This is a server-side request forgery (SSRF) vulnerability (CWE-918) in SurrealDB's HTTP functions. The vulnerability stems from insufficient validation of HTTP redirects when accessing external endpoints. An authenticated attacker can chain HTTP 301/307 redirects from an attacker-controlled server to reach IP addresses that the administrator has explicitly blocked via the --deny-net flag. Because SurrealDB follows these redirects and returns response data to the attacker, this results in a full SSRF attack. The vulnerability affects versions before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1. The fix adds HTTP redirect limits and validates redirects against the network allowlist to prevent redirections to disallowed URIs. Authentication is required to exploit this issue, and the attacker must be able to host a server on the public internet.
Affected products
- SurrealDB SurrealDB < 2.0.5, >= 2.1.0 and < 2.1.5, >= 2.2.0 and < 2.2.2
Timeline
- 2025-04-10: disclosed: Vulnerability disclosed by Cure53 during security audit and penetration test
- 2025-04-11: patched: Patches released: versions 2.0.5, 2.1.5, 2.2.2 and later
- 2025-04-11: advisory: GitHub Advisory GHSA-5q9x-554g-9jgg published