Attack Chain

1. An unauthenticated attacker identifies an exposed SurrealDB RPC API instance in a target environment.
2. The attacker determines that a record access method defines a SIGNIN or SIGNUP query, making the vulnerability exploitable.
3. The attacker crafts a binary object that leverages the bincode serialization format to embed a malicious subquery.
4. The attacker sends this specially crafted binary object as part of a signin or signup operation to the vulnerable RPC API endpoint.
5. SurrealDB's RPC API processes the arbitrary object without proper recursive validation of non-computed values, leading to the acceptance and processing of the malicious subquery.
6. The embedded subquery is executed within the database owner's SIGNIN/SIGNUP query context.
7. The subquery runs under a system user session, inheriting an editor role, and performs unauthorized actions.
8. The attacker's subquery successfully selects, creates, updates, or deletes non-IAM resources within the SurrealDB database, achieving unauthorized data manipulation.

Impact

Successful exploitation of CVE-2024-58362 allows an unauthenticated attacker to gain significant control over the SurrealDB database's non-IAM resources. Attackers can execute arbitrary subqueries, leading to unauthorized selection, creation, modification, or deletion of data. This could result in data theft, data corruption, or the complete compromise of information stored within the database. While the attacker cannot directly view the results of the query or affect IAM resources (which require an 'owner' role), the ability to manipulate core database content at an 'editor' level presents a critical risk to data integrity and confidentiality.

Recommendation

• Patch CVE-2024-58362 immediately by upgrading SurrealDB to version 1.5.5 or later, or 2.0.0-beta.3 or later, to remediate the arbitrary object execution vulnerability.
• Restrict network exposure of the SurrealDB RPC API to trusted users and internal networks only, preventing untrusted users from accessing vulnerable endpoints.
• Monitor SurrealDB RPC API logs for unusual signin or signup requests originating from suspicious IP addresses or containing abnormally large or malformed payloads, as these could indicate an attempted exploitation of CVE-2024-58362.