Summary
ArcadeDB fails to enforce scripting authorization checks for SQL DEFINE FUNCTION statements using LANGUAGE js, allowing non-admin users to register executable JavaScript functions.
When an attacker has database access, they can bypass intended scripting restrictions and execute arbitrary JavaScript within the database environment.
Affected context
This vulnerability appears in ArcadeDB deployments that:
- Allow users to issue SQL
DEFINE FUNCTIONstatements - Support JavaScript-based functions via
LANGUAGE js - Rely on role- or permission-based controls to restrict scripting capabilities to administrators
The issue is most relevant where multi-tenant or shared database access exists and the database trusts that only privileged roles can register executable scripts.
Exploit preconditions
- Attack surface: Logical database interface (SQL over network or local connection)
- Required access: Valid database credentials with permission to execute SQL statements, but without explicit scripting/admin privileges
- Trigger point: Submission of
DEFINE FUNCTION ... LANGUAGE jsstatements that the server accepts without proper authorization checks - Why exploitation is possible: The authorization layer does not correctly enforce that only administrators can define JavaScript-backed functions, so regular users can introduce and run arbitrary JS code under elevated execution context.
Why this happens
The root cause is a missing or incomplete authorization check on the SQL DEFINE FUNCTION path when LANGUAGE js is specified.
Instead of consistently verifying that only privileged roles can create script-backed functions, the implementation treats these statements as if they were regular schema operations.
This maps to CWE-863: Incorrect Authorization, where the system fails to validate that the caller has the required permissions for an operation that enables code execution.
Abstractly, the bug pattern is: "executable scripting or stored procedures exposed through general-purpose DDL without a corresponding privilege gate."
Potential impact
- Attackers with basic database access can execute arbitrary JavaScript in the database runtime.
- Malicious functions can read or modify sensitive data beyond the attacker's intended role.
- Stored JS functions can be used as persistence mechanisms, re-triggered by application logic.
- Data integrity can be compromised through unauthorized updates, deletions, or business logic tampering.
- In some deployments, JavaScript execution may provide a bridge to underlying system resources or services, increasing the blast radius.
General mitigation guidance
Mitigation centers on tightening authorization boundaries around scripting and executable functions.
Common defensive patterns include:
- Ensuring that any operation introducing executable code (scripts, stored procedures, JS functions) is guarded by explicit, role-based checks.
- Separating "schema management" privileges from "code execution" privileges, and assigning them only to trusted administrators.
- Disabling or restricting JavaScript-backed functions in environments where they are not strictly required.
- Applying least privilege for database roles and limiting who can issue DDL that affects functions or triggers.
- Introducing defense-in-depth controls such as whitelisting allowed function names or modules and logging all function definition changes for review.
These measures reduce the risk even if a similar logic flaw were reintroduced in the scripting layer.
How teams detect issues like this
Detection typically involves a combination of configuration review, query auditing, and code analysis:
- Enable and review audit logs for
DEFINE FUNCTIONstatements, especially those specifyingLANGUAGE js, to spot unexpected users defining scripts. - Use database security policies or monitoring tools to flag non-admin roles performing DDL involving functions or executable code.
- In code reviews, treat any feature that introduces scripting or dynamic evaluation as high risk and validate that authorization checks exist and are enforced consistently.
- Apply static or policy-based analysis to database migration scripts and application code to detect ungoverned use of script-backed functions.
Automated database governance tools can assist by enforcing guardrails on who can define or modify executable functions.
