ray-project · ray-project/ray
A command injection flaw in the cpu_profile URL parameter of the Ray dashboard, part of the ray-project/ray product, lets an attacker run OS commands on the host running the dashboard. The attack is remote and requires no authentication, no user interaction, and only network access to the dashboard.
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Public exploit code (Metasploit) was available 1 day before disclosure.
remote unauthenticated exploit via dashboard URL parameter
allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication
OS command execution on host
allowing attackers to execute os commands on the system
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: ray.
Upgrade to 2.52.0 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2023-48022, CVE-2023-6020, +2).
pip install "ray>=2.52.0"First fixed in 2.8.1 for CVE-2023-6019.
| If you run | Upgrade to |
|---|---|
| All versions before 2.8.1 | 2.52.0first fix for this CVE: 2.8.1 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2023-6019 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.