Summary
ArcadeDB exposes the real LocalDatabase object to JavaScript triggers with overly broad host access, allowing schema administrators to perform security operations that bypass permission checks.
An attacker with UPDATE_SCHEMA rights can craft a JavaScript trigger that calls getSecurity().createUser(), creating server-wide admin accounts and escalating privileges beyond their intended authorization level.
Affected context
This vulnerability arises in ArcadeDB deployments that use JavaScript triggers bound to the LocalDatabase object with HostAccess.ALL.
It is relevant where:
- Users have UPDATE_SCHEMA or similar schema-management permissions
- JavaScript-based triggers are enabled and executed on database events
- Security-sensitive APIs (e.g., getSecurity().createUser()) are reachable from trigger contexts without additional authorization checks
Exploit preconditions
- Attack surface: Database trigger subsystem in ArcadeDB
- Required access: Valid database account with UPDATE_SCHEMA or equivalent schema modification permissions
- Trigger point: Creation and execution of JavaScript triggers attached to schema or data operations
- Why exploitation is possible: The LocalDatabase object is injected into JavaScript trigger contexts with HostAccess.ALL, exposing security-management methods that are not re-validated against the caller's permissions
Why this happens
The core issue is an authorization bypass caused by overly permissive bridging between the database engine and embedded JavaScript execution.
By binding the LocalDatabase object into the script context using HostAccess.ALL, ArcadeDB exposes sensitive methods such as getSecurity().createUser() directly to trigger code.
This maps to CWE-269: Improper Privilege Management, where a component fails to enforce proper permission checks for operations that change security state, allowing users with limited roles to perform administrator-level actions.
Potential impact
- Attackers may create new server-wide administrator accounts with full privileges
- Existing low-privileged or schema-only accounts could escalate to full database control
- Administrative controls and access policies may be silently bypassed
- Compromised accounts can modify or exfiltrate sensitive data across all databases
- Subsequent abuse of admin-level access could facilitate lateral movement to connected systems
General mitigation guidance
Effective mitigation focuses on tightening privilege boundaries between scripting environments and core security APIs.
Common defensive patterns include:
- Limiting host access for embedded scripting (e.g., using restricted HostAccess or whitelisting safe methods)
- Ensuring that security-sensitive APIs perform independent authorization checks, regardless of call origin
- Separating schema-management permissions from security-administration capabilities
- Restricting who can define or modify triggers, and treating trigger creation as a high-privilege operation
- Applying least-privilege configurations so that schema-level users cannot indirectly reach global security controls
How teams detect issues like this
Organizations can detect similar issues through:
- Static analysis or configuration linting that flags use of HostAccess.ALL or equivalent unrestricted bindings to sensitive objects
- Code reviews focused on trigger definitions, especially where JavaScript or other embedded languages can access database internals
- Policies that require explicit approval and auditing for changes to triggers and security-related scripts
- Automated tooling that scans for calls to security-management APIs (e.g., getSecurity().createUser()) inside trigger code
- Runtime logging and monitoring of user-creation events correlated with trigger execution to spot abnormal patterns
