Incorrect Default Permissions Affecting surrealdb package, versions <1.0.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-SURREALDB-6129066
- published 15 Dec 2023
- disclosed 15 Dec 2023
- credit LucyEgan
How to fix?
Upgrade surrealdb to version 1.0.1 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Default Permissions due to the default configuration of table permissions. Any authorized client can create, read, update, and delete data in tables that were defined without explicit permissions and are within their authorization scope. This is particularly critical for instances allowing guest access with publicly exposed interfaces, as a remote unauthenticated user may gain full access to tables without explicit permissions.
Workaround
This vulnerability can be mitigated by explicitly defining table permissions using the PERMISSIONS clause in the table definition.