Uncaught Exception Affecting surrealdb-core package, versions <2.1.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-SURREALDBCORE-8400849
- published24 Nov 2024
- disclosed22 Nov 2024
- creditFinn Bear, extrawurst
Introduced: 22 Nov 2024
CVE NOT AVAILABLE CWE-248 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade surrealdb-core to version 2.1.0 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception through the ORDER BY rand() clause. This is only exploitable if the attacker has authorization to run queries on the SurrealDB server.
Workaround
Users who are unable to upgrade to the fixed version are advised to limit the ability of untrusted clients to run arbitrary SurrealQL queries in the affected versions and ensuring that the SurrealDB process is configured to automatically restart after a crash.