CVE-2024-58362
Full vulnerability record from the local CVENow database.
Description
SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-18 14:17:09.047000
Last modified
2026-10-27 18:10:00.130000
View original CVE JSON
{
"id": "CVE-2024-58362",
"sourceIdentifier": "[email protected]",
"published": "2026-07-18T14:17:09.047",
"lastModified": "2026-10-27T18:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role)."
},
{
"lang": "es",
"value": "SurrealDB antes de 1.5.5 (y 2.0.0-beta antes de 2.0.0-beta.3) acepta un objeto arbitrario en las operaciones de inicio de sesión y registro de la API RPC sin validarlo recursivamente para valores no calculados. Cuando un método de acceso a registros define una consulta SIGNIN o SIGNUP y la API RPC está expuesta a usuarios no confiables, un atacante no autenticado puede codificar un objeto binario que contiene una subconsulta utilizando el formato de serialización bincode y proporcionarlo en lugar de las credenciales. La subconsulta se ejecuta entonces dentro de la consulta SIGNIN/SIGNUP del propietario de la base de datos bajo una sesión de usuario del sistema con el rol de editor, permitiendo al atacante seleccionar, crear, actualizar y eliminar recursos que no son IAM (aunque no puede ver los resultados de la consulta directamente, y no afecta a los recursos IAM, que requieren el rol de propietario)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "0",
"lessThan": "1.5.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.5.5",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "2.0.0-beta.1",
"lessThan": "2.0.0-beta.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.0.0-beta.3",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb-core",
"versions": [
{
"version": "0",
"lessThan": "1.5.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.5.2",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-20T17:26:21.922837Z",
"id": "CVE-2024-58362",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-75"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.5",
"matchCriteriaId": "F9F313F1-9962-4BCB-BE7F-C00DE28ED93D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "72D726D4-3F2D-4176-BDD5-E0A85E3D141B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:2.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "2F50FC91-907A-4D6A-9C04-A9E5130920E1"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}