CVE-2023-48023

CRITICALNuclei

Anyscale Ray 2.6.3 and 2.8.0 - Server-Side Request Forgery

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-48023 has a selected CVSS score of 9.1 (critical); EIP currently links 1 Nuclei template.

Description

Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 1, 2023 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALAnyscale Ray 2.6.3 and 2.8.0 - Server-Side Request ForgeryCVSS 9.1

The Ray Dashboard API is affected by a Server-Side Request Forgery (SSRF) vulnerability in the url parameter of the /log_proxy API endpoint. The API does not perform sufficient input validation within the affected parameter and any HTTP or HTTPS URLs are accepted as valid.

Impact

The issue is exploitable without authentication and is dependent only on network connectivity to the Ray Dashboard port (8265 by default). The vulnerability could be exploited to retrieve the highly privileged IAM credentials required by Ray from the AWS metadata API. As an impact it is known to affect confidentiality, integrity, and availability.

Remediation

Update to the latest version

WeaknessesCWE-441CWE-918
Authorscookiehanhoan, harryha
Template tagscvecve2023ssrfrayanyscaleAnyscalevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Shodan: http.favicon.hash:463802404
Shodan: http.html:"ray dashboard"
FOFA: icon_hash=463802404
FOFA: body="ray dashboard"
https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0 https://huntr.com/bounties/448bcada-9f6f-442e-8950-79f41efacfed/ https://security.snyk.io/vuln/SNYK-PYTHON-RAY-6096054 https://nvd.nist.gov/vuln/detail/CVE-2023-48023

Source: ProjectDiscovery

References

3