CVE-2023-6019: ray_project ray OS Command Injection

Vulnerability summary

CVE-2023-6019 is a critical (CVSS 9.8) OS Command Injection vulnerability in ray_project ray. EPSS estimates a 74.63% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 16-11-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.