Ray Command Injection in cpu_profile Parameter
85Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.8epss 75%
from disclosure to weapon146 days
Published on NVDNov 16
1st PoC+146d
metasploitNov 15
exploitation probability
75%top 1% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ray-project · ray-project/raypublic PoCs found — 5
exploitdbwww.exploit-db.com/exploits/51978unverifiedgithubgithub.com/joaquinrrr/CVE-2023-6019★ 6githubgithub.com/Clydeston/CVE-2023-6019★ 2githubgithub.com/FireWolfWang/CVE-2023-6019★ 1githubgithub.com/Zohaibkhan1472/cve-2023-6019★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.