CVE-2024-58357 Overview
CVE-2024-58357 is a denial of service vulnerability in SurrealDB versions before 2.1.0. The flaw resides in the rand::time() function, which panics when unwrap is called on a None result returned from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliably trigger server panics, causing the SurrealDB process to terminate. The issue is tracked under [CWE-248] Uncaught Exception. Any authenticated user with query privileges can exploit the flaw remotely over the network.
Critical Impact
Authenticated attackers can crash SurrealDB server instances on demand by invoking the built-in rand::time() function, resulting in service outage for all connected clients.
Affected Products
- SurrealDB versions prior to 2.1.0
- SurrealDB server deployments exposing the query interface to authenticated clients
- Applications embedding SurrealDB as a networked database backend
Discovery Timeline
- 2026-07-18 - CVE-2024-58357 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2024-58357
Vulnerability Analysis
The vulnerability is a denial of service condition caused by an uncaught exception in SurrealDB's random number generation subsystem. The rand::time() built-in function generates a random value derived from a timestamp. Internally, the implementation calls timestamp_opt and then invokes unwrap on the returned Option. When timestamp_opt returns None for certain inputs, the unwrap call triggers a Rust panic. The panic propagates up through the query execution thread and terminates the SurrealDB server process. Because the function is exposed to any authenticated client with query permissions, exploitation is trivial and repeatable.
Root Cause
The root cause is unsafe error handling in the rand::time() implementation. The code assumes timestamp_opt will always return a valid Some(value), but the underlying chrono API returns None for out-of-range or ambiguous timestamps. Calling unwrap on that None value produces a panic instead of a recoverable error. SurrealDB did not wrap the operation in a fallible path that would return a query error to the client. This design flaw maps to [CWE-248] Uncaught Exception.
Attack Vector
Exploitation requires network access to the SurrealDB endpoint and valid credentials with query execution privileges. An attacker submits a query invoking rand::time() through the standard SurrealQL interface. The server thread panics and the process terminates, disconnecting all active clients. No specialized tooling is required — a single query string containing the built-in function call is sufficient. Repeated invocation after restart produces persistent service disruption.
See the GitHub Security Advisory and the VulnCheck Denial of Service Advisory for additional technical details.
Detection Methods for CVE-2024-58357
Indicators of Compromise
- SurrealDB process crashes or restarts correlated with client query activity
- Panic messages in SurrealDB logs referencing rand::time or unwrap on None
- Abrupt termination of client connections without clean shutdown events
- Query logs containing repeated calls to rand::time() from a single authenticated principal
Detection Strategies
- Enable SurrealDB query logging and alert on queries invoking rand::time() at high frequency
- Monitor process supervisor logs (systemd, Kubernetes) for repeated SurrealDB restart events
- Correlate authentication events with subsequent server panics to identify the exploiting account
- Deploy runtime crash reporting to capture Rust panic backtraces from the SurrealDB binary
Monitoring Recommendations
- Track SurrealDB uptime and restart counts as a service health metric
- Alert on any log line matching panicked at or called \Option::unwrap()` on a `None` value` in SurrealDB output
- Baseline normal query patterns per user and flag anomalous invocation of built-in functions
- Forward SurrealDB logs to a centralized logging platform for retention and query analysis
How to Mitigate CVE-2024-58357
Immediate Actions Required
- Upgrade SurrealDB to version 2.1.0 or later on all server instances
- Audit database user accounts and revoke query privileges from untrusted principals until patching is complete
- Restrict network access to the SurrealDB endpoint to known application hosts
- Review authentication logs for suspicious query activity involving rand::time()
Patch Information
The vulnerability is fixed in SurrealDB 2.1.0. The patched release replaces the unwrap call in rand::time() with proper error propagation, so invalid timestamp conditions surface as query errors rather than process panics. Refer to the GitHub Security Advisory GHSA-h4f5-h82v-5w4r for the official fix reference.
Workarounds
- Restrict database roles so that only trusted service accounts can execute arbitrary SurrealQL queries
- Place SurrealDB behind an application-layer proxy that filters queries containing rand::time() calls
- Run SurrealDB under a process supervisor that automatically restarts on crash to reduce outage duration
- Segment SurrealDB instances so that a crash in one tenant does not affect unrelated workloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
