critical9.8Public exploit code
CVE-2023-6019
Ray OS Command Injection vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ray OS v2.6.3 - Command Injection RCE(Unauthorized)2024-04-12 · webapps · python
Impact
A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ray | < 2.8.1 | 2.8.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ray Project | Ray | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe
- https://github.com/advisories/GHSA-h3xg-wv58-5p43
- https://nvd.nist.gov/vuln/detail/CVE-2023-6019
- https://github.com/ray-project/ray/releases/tag/ray-2.8.1
- https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023