Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-6wr5-jmpr-mjcx
GHSA-6wr5-jmpr-mjcx:
Rust vulnerability analysis and mitigation
Overview
A moderate severity vulnerability (GHSA-6wr5-jmpr-mjcx) was discovered in SurrealDB versions 1.1.1 and earlier, where the query executor would panic when executing a query containing a call to a non-existent built-in SurrealDB function. This vulnerability could be triggered when using a newer version of the SurrealDB client with an older server version, or when pre-parsed queries were provided via a newer version of the SurrealDB SDK. The issue was discovered on January 15, 2024, and was fixed in version 1.2.0 (GitHub Advisory).
Technical details
The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Moderate) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue is classified under CWE-248 and occurs when the query executor encounters an invalid builtin function name, causing an unhandled panic instead of returning an appropriate error message. The vulnerability requires network access and low privileges to exploit, with no user interaction needed (GitHub Advisory).
Impact
When successfully exploited, this vulnerability allows an authorized client to cause a denial of service by crafting and executing a pre-parsed query that invokes a nonexistent built-in function. This results in a server crash, disrupting service availability for all users (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in SurrealDB version 1.2.0. For users unable to update, it is recommended to limit the ability of untrusted users to run arbitrary SurrealQL queries. Additionally, administrators should ensure that the SurrealDB process is configured to automatically restart after a crash to minimize the impact of potential denial of service attacks (GitHub Advisory, GitHub PR).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management