CVE-2023-6021

HIGHNuclei

Ray Log File Local File Include

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-6021 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 27, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

ray-project/ray

Browse ray-project / ray-project/ray

Default status: unaffected

CVE ListThrough latestaffected

ray

Browse PyPI / ray
GitHub AdvisoryBefore 2.8.1 · Fixed in 2.8.1affected

Nuclei templates

1
ProjectDiscoveryHIGHRay API - Local File InclusionCVSS 7.5

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication.

Impact

Unauthenticated attackers can read any file on the server via the log API endpoint, potentially accessing sensitive configuration files, credentials, and application data.

Remediation

Update Ray to a patched version that properly validates file paths in the logs endpoint.

WeaknessesCWE-22CWE-29
Authorsbyt3bl33d3r
Template tagscvecve2023lfirayoosray_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*
Shodan: html:"Ray Dashboard"
Shodan: http.favicon.hash:463802404
Shodan: http.html:"ray dashboard"
FOFA: body="ray dashboard"
FOFA: icon_hash=463802404
https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8/ https://nvd.nist.gov/vuln/detail/CVE-2023-6021

Source: ProjectDiscovery

References

5