Ray < 2.8.1 - Unauthenticated Remote Code Execution via CPU Profile URL Parameter
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2023-6019.
PoCs published by Fire_Wolf, Clydeston, FireWolfWang, including Metasploit module exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.
AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in Ray OS v2.6.3 via the CPU profiling page's 'format' parameter, allowing arbitrary command execution. It uses a base64-encoded reverse shell payload injected into the system command, potentially escalating to root if sudo is passwordless.
Description
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Exploits (5)
This exploit demonstrates a command injection vulnerability in Ray OS v2.6.3 via the CPU profiling page's 'format' parameter, allowing arbitrary command execution. It uses a base64-encoded reverse shell payload injected into the system command, potentially escalating to root if sudo is passwordless.
This PoC exploits a command injection vulnerability in the target software by sending a crafted HTTP request with a base64-encoded reverse shell payload. The payload is executed via the `format` parameter in the CPU profile endpoint.
This is a functional exploit for CVE-2023-6019, targeting a command injection vulnerability in the Ray Project dashboard's CPU profiling page. It leverages an unauthenticated RCE via the 'format' parameter to execute arbitrary commands, potentially escalating to root if sudo is passwordless.
This repository contains a proof-of-concept for CVE-2023-6019, demonstrating a command injection vulnerability in a Ray monitoring endpoint. The PoC includes a Flask-based dashboard for testing payloads, a WAF filter for mitigation, and a monitoring service that logs suspicious requests.
This Metasploit module exploits a command injection vulnerability in Ray's cpu_profile endpoint (CVE-2023-6019) by injecting commands via the 'format' parameter. It supports multiple architectures and uses a cmdstager for payload delivery.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H