CVE-2023-6019
Ray Command Injection in cpu_profile Parameter
- Published
- Nov 16, 2023
- Updated
- Aug 2, 2024
- Assigning CNA
- @huntr_ai
- Evidence observed
- Apr 12, 2024
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.5%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Sources
modules/exploits/linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.platform)
- verification: check_declared($.exploit_linux/http/ray_cpu_profile_cmd_injection_cve_2023_6019.check)
- CVE-2023-6019Exploit
PoC exploit for CVE-2023-6019 targeting unauthenticated Remote Code Execution in Anyscale Ray Dashboard via the Jobs API. Delivers a reverse shell on vulnerable Ray instances (< 2.6.4).
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.