CVE-2023-6019

🗓️ 16 Nov 2023 16:12:07Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 162 Views🌐 WEB

A command injection in Ray's cpu_profile URL parameter allows remote code execution without authentication

Reporter	Title	Published	Views	Family All 74
0day.today	Ray OS v2.6.3 - Command Injection Exploit	12 Apr 202400:00	–	zdt
0day.today	Ray cpu_profile Command Injection Exploit	27 Aug 202400:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	21 Apr 202414:30	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	28 Oct 202520:04	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	19 Jun 202619:08	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Ray_Project Ray	10 Apr 202409:24	–	githubexploit
ATTACKERKB	CVE-2023-48023	28 Nov 202308:15	–	attackerkb
BDU FSTEC	The vulnerability of the dashboard component of the application scaling framework for AI and Python Ray applications, which allows a hacker to execute arbitrary commands.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to deficiencies in the authentication process, allows attackers to read arbitrary files from the /static/ directory.	3 Apr 202400:00	–	bdu_fstec
Circl	CVE-2023-48023	17 Dec 202316:42	–	circl

NVD

Node

ray_project rayMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "ray-project/ray",
    "vendor": "ray-project",
    "versions": [
      {
        "lessThanOrEqual": "latest",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe

Parameter	Position	Path	Description	CWE
pid	query param	worker/cpu_profile	Command injection via cpu_profile endpoint where format parameter is unsafely constructed to execute arbitrary commands	CWE-78
ip	query param	worker/cpu_profile	Command injection via cpu_profile endpoint where format parameter is unsafely constructed to execute arbitrary commands	CWE-78
duration	query param	worker/cpu_profile	Command injection via cpu_profile endpoint where format parameter is unsafely constructed to execute arbitrary commands	CWE-78
native	query param	worker/cpu_profile	Command injection via cpu_profile endpoint where format parameter is unsafely constructed to execute arbitrary commands	CWE-78
format	query param	worker/cpu_profile	Command injection via cpu_profile endpoint where format parameter is unsafely constructed to execute arbitrary commands	CWE-78
entrypoint	path	api/jobs/	Unauthenticated remote code execution via Ray Jobs API vulnerable pre-2.6.4 allowing submission of jobs leading to RCE	CWE-77
runtime_env	path	api/jobs/	Unauthenticated remote code execution via Ray Jobs API vulnerable pre-2.6.4 allowing submission of jobs leading to RCE	CWE-77
job_id	path	api/jobs/	Unauthenticated remote code execution via Ray Jobs API vulnerable pre-2.6.4 allowing submission of jobs leading to RCE	CWE-77
metadata	path	api/jobs/	Unauthenticated remote code execution via Ray Jobs API vulnerable pre-2.6.4 allowing submission of jobs leading to RCE	CWE-77
{filepath}	path	static/js/../../../../../../../../../../../../../..{filepath}	Local file inclusion through crafted path traversal in static resource path	CWE-77

17 Jun 2026 06:49Current

8.9High risk

Vulners AI Score8.9

CVSS 3.19.8

EPSS0.7463

CWE-78