【中危】surrealdb 安全更新（GHSA-h4h3-3rfj-x6fq）

安全情报快照 · 风险级别：中危 · CVSS：4.3 · GHSA-h4h3-3rfj-x6fq

先看结论

surrealdb存在安全风险，>= 3.0.0, < 3.1.5 受影响，建议升级至 3.1.5。

影响范围

生态	组件	受影响版本	首个修复版本
rust	`surrealdb`	>= 3.0.0, < 3.1.5	3.1.5

处置建议

优先将 surrealdb 升级至 3.1.5 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

A field can be hidden from a user with a field-level SELECT permission (DEFINE FIELD code ON secret PERMISSIONS FOR select WHERE owner = $auth.id). When that field is indexed, a record user who cannot read it could still recover the relative ordering of its values across every record by issuing ORDER BY <field>: the field came back null as intended, but the rows were returned in the hidden values' true sorted order.

To satisfy the sort, the planner selects the field's index and walks it in value order; the field-level permission is applied later, when the row is projected, so the value is nulled but the row order already encodes it. The guard that withholds restricted fields from the WHERE path was never applied to ORDER BY.

Impact

What an attacker can do:

As a record (scope) user with table SELECT, learn the relative ordering of a field hidden by a field-level SELECT permission, across other users' records, by ordering on it when an index covers the field — the value returns null, but the rows come back in the hidden values' order.
With rows they control in the same table, use that ordering to narrow the hidden values toward exact ones.

What it can't do:

Read the field value directly — only its relative ordering leaks; the projected value is correctly redacted.
Cross table, record, or namespace/database boundaries — the table's SELECT permission and any row-level WHERE are still enforced, so only records the caller may already read are ordered.
Leak anything when the restricted field is not indexed, affect root or record-owner sessions, or modify data (confidentiality only).

Patches

The query planner now applies the field-permission guard to the ORDER BY clause as well as the WHERE clause. When an ordered field is hidden from the caller by a field-level SELECT permission, the index sort pushdown is withheld and the rows are sorted after redaction instead, so the row order no longer reflects the hidden values. The dynamic-scan fallback is closed the same way, and a regression test was added.

The fix is included in SurrealDB 3.1.5.

Workarounds

Users unable to upgrade are advised to consider the following:

Force the legacy executor with SURREAL_PLANNER_STRATEGY=compute-only; the sort then runs after redaction, so no ordering leaks.
Do not place an index on a field whose values are hidden by a field-level SELECT permission — without the index the leak does not occur.
Do not rely on field-level SELECT permissions to hide values on indexed fields from record users; restrict at the table level instead.
Use namespace / database isolation as the primary trust boundary where feasible.

References

SurrealQL Documentation — DEFINE FIELD
SurrealQL Documentation — DEFINE INDEX
SurrealQL Documentation — DEFINE TABLE … PERMISSIONS
Related advisory (same class, indexed COUNT variant): GHSA-c8jx-96c9-8xrp
fix(planner): prevent ORDER BY value-ordering oracle on restricted SELECT fields
fix(planner): close ORDER BY value-ordering oracle on the DynamicScan fallback

Acknowledgements

Thanks to George Chen (@geo-chen) for finding and reporting this issue.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。