Default Overpermissive Table Access in SurrealDB

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SurrealDB versions prior to 1.0.1 configured default table permissions to FULL instead of the secure default of NONE, enabling unrestricted SELECT, CREATE, UPDATE, and DELETE operations on tables lacking explicit permission controls. This vulnerability affects any organization deploying SurrealDB in production environments, particularly those with database instances exposed to untrusted networks or users. The risk escalates significantly for publicly accessible instances where even unauthenticated users could exploit this misconfiguration to perform unauthorized data manipulation, exfiltration, or destruction. With a CVSS score of 8.8, this represents a critical security posture gap that can lead to complete compromise of data integrity and confidentiality within affected deployments.

Casky's 224 matching skills leverage Claude AI's extended reasoning to identify the attack patterns underlying this permission escalation vulnerability, mapping directly to MITRE ATT&CK's TA0004 (Privilege Escalation) tactic. Practitioners using Casky would observe detection signals for unauthorized table access attempts, anomalous data modification operations on unprotected tables, and permission boundary violations that bypass intended access controls. The platform's skill set enables practitioners to correlate suspicious query patterns—particularly unexpected CREATE, UPDATE, or DELETE operations—with database authentication logs to distinguish between legitimate administrative actions and exploitation attempts. By analyzing permission configuration drift and access control enforcement failures, Casky helps security teams identify instances where default FULL permissions were never intentionally configured, revealing infrastructure misalignment with the principle of least privilege.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2023-54366.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2023-54366

Casky has 224 skills that investigate the attack patterns behind CVE-2023-54366. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn