GHSA-64f8-pjgr-9wmr: 
Rust vulnerability analysis and mitigation

A high severity vulnerability (GHSA-64f8-pjgr-9wmr) was discovered in SurrealDB's RPC API affecting versions <1.5.5 and <2.0.0-beta.3 of surrealdb and <1.5.2 of surrealdb-core packages. The vulnerability was disclosed and patched on September 11, 2024. The issue allowed arbitrary object evaluation during sign-in and sign-up operations through the RPC API when using the bincode serialization format (GitHub Advisory).

During sign-in and sign-up operations through the SurrealDB RPC API, the system would accept arbitrary objects to support various credential types and structures. When using the bincode serialization format (instead of JSON or CBOR), an attacker could provide a binary object containing a subquery that would be executed while processing SIGNIN and SIGNUP queries defined in record access methods. These queries would be executed under a system user session with editor role privileges (GitHub Advisory).

If a record access method was configured with SIGNIN or SIGNUP queries and the SurrealDB RPC API was exposed to untrusted users, an attacker could craft a binary object containing a subquery to execute during authentication. This would allow them to select, create, update, and delete non-IAM resources with system user editor role permissions. However, attackers could not directly view query results or manipulate IAM resources, as those require owner role privileges (GitHub Advisory).

For users unable to update, several workarounds are available: 1) Restrict access to the SurrealDB RPC API by only allowing requests to the /rpc endpoint with application/json content type, 2) If the RPC API is only used by trusted clients or not used at all, disable or restrict access to the /rpc endpoint, 3) Temporarily remove record access methods that define SIGNIN and SIGNUP clauses. The permanent fix involves updating to versions 1.5.5 or later for the 1.x series, or 2.0.0-beta.3 or later for the 2.x series, which implement validation of objects provided during sign-in and sign-up operations (GitHub Advisory).