CVE-2023-6019
Ray Command Injection in cpu_profile Parameter
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ray-project · ray-project/raypublic PoCs found — 5
githubgithub.com/joaquinrrr/CVE-2023-6019★ 6githubgithub.com/Clydeston/CVE-2023-6019★ 2githubgithub.com/FireWolfWang/CVE-2023-6019★ 1githubgithub.com/Zohaibkhan1472/cve-2023-6019★ 0exploitdbwww.exploit-db.com/exploits/51978unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →