-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| surrealdb | rust | >= 2.2.0, < 2.2.2 | 2.2.2 |
| surrealdb | rust | < 2.0.5 | 2.0.5 |
| surrealdb | rust | >= 2.1.0, < 2.1.5 | 2.1.5 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that SurrealDB's JavaScript script functions lacked a default timeout, potentially leading to a DoS. I analyzed the provided pull request (https://github.com/surrealdb/surrealdb/pull/5597) and its associated commits. The commit fd286b9b3734d44f50b1bfdfdc918b210b438ae1 directly addresses this issue.
In this commit, the file crates/core/src/fnc/script/main.rs contains the run function, which is responsible for executing JavaScript scripts. The diff shows the introduction of a timeout mechanism within this run function: a start time (instant_start) is recorded, a time_limit is established (read from the new SCRIPTING_MAX_TIME_LIMIT configuration), and the interrupt handler for the JavaScript runtime is modified to check if this time limit has been exceeded.
Before this change, the interrupt handler only checked for external cancellation (cancellation.is_done()), meaning a script could run indefinitely if not externally cancelled, thus consuming resources and leading to a DoS. The run function is therefore the direct site of the vulnerability because it's where the unbounded execution occurred. Other changes in the commit, such as those to foreach.rs or HTTP handling, address related but distinct issues (long-running loops in SurrealQL or HTTP redirect limits) rather than the core JavaScript execution timeout vulnerability.