{"id":"CVE-2023-6020","published":"2023-11-16T21:07:33Z","modified":"2024-08-02T08:21:17Z","title":"Ray Static File Local File Include","vendor":"ray-project","product":"ray-project/ray","tier":"core","eol":null,"affectedVersions":[{"vendor":"ray-project","product":"ray-project/ray","versions":[">= unspecified, <= latest"]}],"description":{"text":"LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.","provenance":"source","from":"CVE.org"},"summary":{"text":"A local file inclusion (path traversal) flaw in the /static/ directory of the Ray project's ray-project/ray product allows attackers to read arbitrary files on the server. The attack requires only network access, with no authentication or user interaction, and the flaw stems from missing authorization checks.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:38Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.14652,"percentile":0.9666,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6","tags":[]}],"techniques":[],"reports":[{"id":"SRC-21b639fa149328c86d0e","title":"ShadowRay: First Known Attack Campaign Targeting AI Workloads Exploited In The Wild","publisher":"oligo.security","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild","date":null,"mentions":[{"quote":"https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023‍[2] https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0‍[3] https://huntr.com/bounties/787a07c0-5535-469f-8c53-3efa4e5717c7/‍[4]","start":25028,"end":25277}]}],"affected":[{"ecosystem":"PyPI","package":"ray","vulnerableRanges":["<2.8.1"],"patched":["2.8.1"],"from":["GHSA-6cxr-8q3m-jwrr","PYSEC-2026-516"],"provenance":"source"}],"advisories":[{"id":"GHSA-6cxr-8q3m-jwrr","url":"https://github.com/advisories/GHSA-6cxr-8q3m-jwrr","severity":"CRITICAL","ecosystem":"PyPI","package":"ray","vulnerableRanges":["<2.8.1"],"patched":["2.8.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2898","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2898","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Ray static arbitrary file read","module":"auxiliary/gather/ray_lfi_cve_2023_6020","type":"auxiliary","disclosureDate":"2023-11-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ray_lfi_cve_2023_6020.rb"}],"nuclei":[{"id":"CVE-2023-6020","name":"Ray Static File - Local File Inclusion","severity":"high","path":"http/cves/2023/CVE-2023-6020.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6020.yaml"}],"first":{"date":"2023-11-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ray_lfi_cve_2023_6020.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-11-15","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ray_lfi_cve_2023_6020.rb","provenance":"source"},{"date":"2023-11-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-6020","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":33.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.33,"detail":"percentile 0.9666"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}