deepstream Valve Permission System Bypass via PATCH_MULTI

Deepstream servers using the Valve (ConfigPermission) permission system are vulnerable to an authorization bypass due to a configuration oversight in the src/services/permission/valve/rules-map.ts file. The RECORD_ACTION.PATCH_MULTI action, introduced in recent versions, was never registered in the RULES_MAP used by the system to evaluate user permissions.

When the server receives a PATCH_MULTI message, the getRulesForMessage() function fails to find a corresponding rule mapping and returns null. The system's security logic is designed to treat a null result as an unconditional allow, effectively bypassing all configured Valve permission rules. This allows any successfully authenticated user, regardless of their defined access level, to write arbitrary data to any record in the system. This vulnerability impacts production environments using the Valve permission model, potentially leading to unauthorized data modification, privilege escalation through record manipulation, and system-wide service disruption.

Attack Chain

1. Attacker performs authentication against the deepstream server using valid, low-privilege credentials.
2. Attacker crafts a malicious WebSocket message with topic: RECORD and action: PATCH_MULTI.
3. Attacker specifies a target record name (e.g., "admin/secret-record") and malicious parsedData in the message payload.
4. The message-processor.ts service receives the request and triggers a permission evaluation call to ConfigPermission.canPerformAction().
5. The permission service invokes getRulesForMessage() to retrieve the policy for PATCH_MULTI.
6. getRulesForMessage() fails to find the action in the RULES_MAP and returns null.
7. The config-permission.ts logic evaluates the null result and defaults to an unconditional grant of access.
8. The server performs the record operation, modifying the target resource as requested by the attacker.

Impact

Successful exploitation allows any authenticated user to bypass all configured security policies, granting them write access to sensitive records and administrative data. Impact includes full data integrity loss, unauthorized privilege escalation if permission records are stored in deepstream, and potential application-level denial of service due to record corruption. Only deployments configured with permission.type: 'config' are affected.

Recommendation

1. Upgrade all instances of @deepstream/server to the version containing the fix for CVE-2026-63116.
2. If an immediate upgrade is not possible, apply a manual patch to src/services/permission/valve/rules-map.ts to include [RECORD_ACTION.PATCH_MULTI]: RULE_TYPES.WRITE.
3. Audit application record logs for suspicious PATCH_MULTI operations originating from low-privilege service accounts or users.
4. Implement strict network-level segmentation to limit the reach of authenticated users to internal deepstream management records.