Ray has arbitrary code execution via jobs submission API
Anyscale Ray allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-48022US | critical9.8OT high | Exploit | ||
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ra… | ||||
02
references
External citations — patches, advisories, analysis.
- https://atlas.mitre.org/studies/AML.CS0023WEB
- https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0WEB
- https://console.vulncheck.com/cve/CVE-2023-48022WEB
- https://docs.ray.io/en/latest/ray-security/index.htmlWEB
- https://docs.ray.io/en/latest/ray-security/token-auth.htmlWEB
- https://github.com/advisories/GHSA-xg2h-7cxj-3gvhADVISORY
- https://github.com/honysyang/RayWEB
- https://github.com/ray-project/rayPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan