« Volver al listado

CVE-2025-71392

Estado: AnalizadaCrítica (9.4)—

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R indica interacción (importar backup). Inyección SurrealQL de segundo orden permite ejecución de comandos y escalada a root en SurrealDB.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (1)

Surrealdb — Surrealdb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-71392",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-71392",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-21T02:39:28.967494Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "surrealdb",
          "product": "surrealdb",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.2.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:cargo/SurrealDB",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "surrealdb",
          "product": "surrealdb",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.1.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:cargo/SurrealDB",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "surrealdb",
          "product": "surrealdb",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.0.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:cargo/SurrealDB",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-18T14:17:10.580",
  "references": [
    {
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized."
    },
    {
      "lang": "es",
      "value": "SurrealDB antes de 2.0.5, 2.1.x antes de 2.1.5, y 2.2.x antes de 2.2.2 no logra escapar correctamente los nombres de tablas y campos en el comando de exportación de línea de comandos. Un Usuario del Sistema autenticado con roles de PROPIETARIO o EDITOR puede crear tablas o campos con nombres maliciosos que contienen SurrealQL. Cuando un usuario con mayores privilegios importa posteriormente la copia de seguridad exportada, el SurrealQL inyectado se ejecuta, lo que permite la escalada de privilegios y la toma de control a nivel de root de la instancia de SurrealDB. Las aplicaciones que permiten a los usuarios definir tablas o campos personalizados también están expuestas a una inyección universal de SurrealQL de segundo orden incluso cuando los parámetros de consulta están saneados."
    }
  ],
  "lastModified": "2026-09-29T19:10:00.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8978D31-3395-4155-8DFF-99FED3F8D7DA",
              "versionEndExcluding": "2.0.5"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D7A2AEC-83EE-46CC-BC91-D5EA1B841E96",
              "versionEndExcluding": "2.1.5",
              "versionStartIncluding": "2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4D2EDCC-A5D1-477A-ADA9-A32389A7D0BE",
              "versionEndExcluding": "2.2.2",
              "versionStartIncluding": "2.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}